Vol.

76 Wednesday,
No. 235 December 7, 2011

Part III

Department of Health and Human Services

Centers for Medicare & Medicaid Services
42 CFR Part 401
Medicare Program; Availability of Medicare Data for Performance
Measurement; Final Rule
emcdonald on DSK5VPTVN1PROD with RULES2

VerDate Mar<15>2010 17:17 Dec 06, 2011 Jkt 226001 PO 00000 Frm 00001 Fmt 4717 Sfmt 4717 E:\FR\FM\[Link] 07DER2
 76542 Federal Register / Vol. 76, No. 235 / Wednesday, December 7, 2011 / Rules and Regulations

DEPARTMENT OF HEALTH AND claims data from sources other than A. Definition, Eligibility Criteria, and
HUMAN SERVICES Medicare with the Medicare data when Operating Requirements of Qualified
evaluating the performance of providers Entities
Centers for Medicare & Medicaid and suppliers. Almost all of the comments were
Services Section 1874(e) of the Act requires positive and praised CMS’ proposals
potential qualified entities that wish to regarding how the qualified entity
42 CFR Part 401 request data under this provision to program would operate. Commenters
[CMS–5059–F] submit an application to the Secretary also had a range of suggestions for how
that includes, among other things, a CMS should administer the program,
RIN 0938–AQ17 description of the methodologies that including several comments on
the applicant proposes to use to performance measurement in general.
Medicare Program; Availability of
evaluate the performance of providers We also received numerous comments
Medicare Data for Performance
and suppliers in the geographic area(s) on data privacy and security, which are
Measurement
they select. Qualified entities generally discussed in more detail in subsection
AGENCY: Centers for Medicare & must use standard measures for D below.
Medicaid Services (CMS), HHS. evaluating the performance of providers
ACTION: Final rule. and suppliers unless the Secretary, in 1. Definitions
consultation with appropriate In the proposed rule, we defined a
SUMMARY: This final rule implements stakeholders, determines that use of qualified entity as a public or private
Section 10332 of the Affordable Care alternative measures would be more entity that meets two standards. The
Act regarding the release and use of valid, reliable, responsive to consumer first is that the entity is qualified, as
standardized extracts of Medicare preferences, cost-effective, or relevant to determined by the Secretary, to use
claims data for qualified entities to dimensions of quality and resource use claims data to evaluate the performance
measure the performance of providers of not addressed by standard measures. of providers and suppliers on measures
services (referred to as providers) and Reports generated by the qualified of quality, efficiency, effectiveness, and
suppliers. This rule explains how entities may only include information resource use. The second is that the
entities can become qualified by CMS to on individual providers and suppliers entity agrees to meet the requirements
receive standardized extracts of claims in aggregate form, that is, at the provider described in Section 1874(e) of the
data under Medicare Parts A, B, and D or supplier level, and may not be Social Security Act and at §§ 401.703–
for the purpose of evaluation of the released to the public until the 401.710 of the proposed rule.
performance of providers and suppliers. providers and suppliers have had an Comment: We received several
This rule also lays out the criteria opportunity to review them and, if comments, suggestions, and questions
qualified entities must follow to protect necessary, ask for corrections. Congress regarding the use of the Medicare data
the privacy of Medicare beneficiaries. included a provision at section qualified entities receive through this
DATES: Effective Date: These regulations 1874(e)(3) of the Act to allow the program. Section 1874(e)(4)(B) of the
are effective January 6, 2012. Secretary to take such actions as may be Act specifies the uses of the Medicare
FOR FURTHER INFORMATION CONTACT: necessary to protect the identity of data. Some commenters requested that
Colleen Bruce, (410) 786–5529. individuals entitled to or enrolled in qualified entities be allowed to use the
SUPPLEMENTARY INFORMATION: Medicare. data for purposes other than
We believe the sharing of Medicare performance reporting, such as internal
I. Background data with qualified entities through this analyses, pay-for-performance
The Patient Protection and Affordable program and the resulting reports initiatives, and provider tiering; other
Care Act (Pub. L. 111–148), enacted on produced by qualified entities will be an commenters requested that CMS clarify
March 23, 2010, and the Health Care important driver of improving quality that the data provided would be used
and Education Reconciliation Act of and reducing costs in Medicare, as well for performance reporting only.
2010 (Pub. L. 111–152), enacted on as for the health care system in general. Response: The statute bars the re-use
March 30, 2010, are collectively referred Additionally, we believe this program of the Medicare claims data provided to
to in this final rule as the ‘‘Affordable will increase the transparency of qualified entities under section 1874(e)
Care Act.’’ Effective January 1, 2012, provider and supplier performance, of the Social Security Act (the Act).
section 10332 of the Affordable Care Act while ensuring beneficiary privacy. Section 1874(e)(4)(D) provides that the
would amend section 1874 of the Social qualified entity ‘‘shall only use such
II. Provisions of the Proposed Rule and
Security Act (the Act) by adding a new data, and information derived from such
Analysis of and Responses to Public
subsection (e) requiring standardized evaluation’’ for performance reports on
Comments
extracts of Medicare claims data under providers and suppliers. Additionally,
parts A, B, and D to be made available We received approximately 100 the Data Use Agreement (DUA,
to ‘‘qualified entities’’ for the evaluation comments from a wide variety of discussed in more detail below) bars re-
of the performance of providers and individuals and organizations. About use of the data for other purposes;
suppliers. Qualified entities may use the half of the comments were from violation of the DUA may result in a
information obtained under section providers and suppliers, or qualified entity’s access to data under
1874(e) of the Act for the purpose of organizations representing providers 1874(e) of the Act being terminated.
evaluating the performance of providers and suppliers. The other half of the However, while the data itself and any
emcdonald on DSK5VPTVN1PROD with RULES2

and suppliers, and to generate public comments were from organizations derivative data may only be used for
reports regarding such performance. engaged in performance measurement or creating the prescribed reports, section
Qualified entities may receive data for data aggregation that may potentially be 1874(e) does not address the use of the
one or more specified geographic areas approved to receive Medicare data as publically reported result. Subject to
and must pay a fee equal to the cost of qualified entities under this program. any limitations imposed by other
making the data available. Congress also We also received a number of comments applicable laws (for example, copyright
required that qualified entities combine from consumer advocacy organizations. laws), these publicly reported results

VerDate Mar<15>2010 17:17 Dec 06, 2011 Jkt 226001 PO 00000 Frm 00002 Fmt 4701 Sfmt 4700 E:\FR\FM\[Link] 07DER2
 Federal Register / Vol. 76, No. 235 / Wednesday, December 7, 2011 / Rules and Regulations 76543

could be used by any party, including in the rule related to experience or a qualified entity, such as a partnership
the qualified entity, for activities such amount of other claims data. or other consortium-like affiliation,
as internal analyses, pay-for- Response: We thank commenters for would not offer the breach of contract
performance initiatives, or provider their support for the eligibility protections that would provide
tiering. standards. While we understand that the assurances that the entities listed as
Qualified entities will not be allowed eligibility standards necessitate that participants in the group would in fact
to do performance measurement with prospective qualified entities have provide the services/skills/resources
Medicare data alone. Section extensive experience in performance that the qualified entity applicant
1874(e)(4)(B)(iii) specifically provides measurement, access to data, and asserts. In a non-contractual
that qualified entities must include appropriate privacy and security arrangement, participating members of
‘‘claims data from sources other than protocols, we believe these standards the group could stop performing at any
claims data under this title in the are essential to ensure both the privacy time, leaving the remainder of the group
evaluation of performance of providers and security of beneficiary data and the with little recourse and, possibly, not
of services and suppliers.’’ We have acceptance of the program by providers qualified to carry on as a qualified
added a definition of ‘‘claims data from and suppliers. entity. This could prevent the issuance
other sources’’ at § 401.703(h). We clarify, however, that qualified of the desired reports. It could also leave
We have made several technical entities do not need to be composed of providers and suppliers, as well as
changes to the definitions at § 401.703 a single legal entity. A qualified entity beneficiaries, without any recourse for
to reflect the regulatory interpretation of applicant may contract with other remedying reporting errors or answering
the statutory provisions cited in the entities to achieve the ability to meet the questions related to the reports. This
proposed rule. We have modified the eligibility criteria. If an entity chooses to would have a very negative effect on the
definition of a qualified entity to require contract with one or more other entities program as a whole, and jeopardize this
the entity to agree to meet the to meet the eligibility standards, the important transparency effort.
requirements in §§ 401.705–401.721 of application must be submitted by one We emphasize that a single entity may
the final rule, removing the proposed lead entity. This lead entity must submit seek to fulfill all of the eligibility
rule’s reference to section 1874(e) of the documentation describing the
standards; there is no requirement that
Act. We have also modified the contractual relationships that exist
a qualified entity must be a group of two
definitions of provider and supplier; between and among all entities applying
or more entities. However, we believe
specifically we have defined both terms together under the lead entity to become
that more potential qualified entities
in terms of the definitions for the a qualified entity. In addition, as
would apply if they use contractual
identical terms at § 400.202. discussed in subsection D.1. below,
relationships to address any
We have also added a definition of contractors will be required to abide by
requirements that they may be lacking.
clinical data. This addition is discussed the same privacy and security
in further detail below. requirements as the lead entity, Comment: Several commenters
including signing a data use agreement suggested additions to the eligibility
2. Eligibility Criteria standards. A handful of commenters
prior to being given access to Medicare
In determining the eligibility claims data or beneficiary information. recommended adding a public input
standards for qualified entities we Contractors will also be subject to CMS component as part of the eligibility
sought to balance the needs to: (1) monitoring and their actions may result process. Commenters also suggested
Ensure the production of timely, high in sanctions and/or termination of the evaluating provider complaints against
quality, and actionable reports on the qualified entity. applicants when making determinations
performance of providers and suppliers, We believe that requiring contractual about qualified entity eligibility. One
(2) protect beneficiary privacy and arrangements among the members of commenter asked CMS to create a
security, and (3) ensure providers and such a group will ultimately protect provisional track for entities without the
suppliers have an appropriate amount of both the providers and suppliers necessary experience or the non-
time to review the reports, appeal, and, receiving reports, as well as the Medicare data to serve as a qualified
if necessary, correct errors prior to beneficiaries seeking to use this entity in the general program.
public reporting. We therefore proposed information to make health care Response: Through evaluating each
to evaluate an organization’s eligibility decisions by ensuring that the lead entity’s (including the lead entity’s and
to serve as a qualified entity across three entity has partners with the necessary any contractors’) past experience, other
areas: Organizational and governance expertise to carry out the duties of a claims data, and privacy and security
capabilities, addition of claims data qualified entity and that the qualified protocols, we are confident that entities
from other sources, and data privacy entity’s partners are committed to the approved as qualified entities will meet
and security. project through legally enforceable the requirements of the program.
Additionally, we proposed not to agreements. Extensive monitoring requirements for
limit the number of qualified entities In a contractual arrangement, there the lead entity and any contractors, as
eligible to serve in an area. Any entity would be breach of contract liability if well as the ability to terminate our
that satisfactorily meets the eligibility one of the members of the group fails to agreement with a qualified entity, will
criteria would be able to participate in deliver, and there would be the ensure that the highest standards are
the program. potential of collecting damages for that adhered to by all qualified entities.
Comment: We received several failure to perform. Such damages would However, we are interested in
comments on the eligibility criteria as a potentially provide the lead entity with beneficiary and/or provider complaints
emcdonald on DSK5VPTVN1PROD with RULES2

whole. Many commenters supported the the resources that would be necessary against a qualified entity once that
proposed eligibility standards; however for finding and hiring another entity to entity is approved. As discussed below
others said the eligibility standards were carry out the functions of a contractor/ in section II.F., we have included an
too prescriptive. Several commenters subcontractor that failed to perform. analysis of beneficiary and/or provider
asked CMS to clarify qualified entities’ Any other less formal arrangement complaints as part of the monitoring
ability to combine expertise across more among a group of entities that, in sum, and performance assessment of
than one entity to meet the requirements possessed the requisite traits required of qualified entities.

VerDate Mar<15>2010 17:17 Dec 06, 2011 Jkt 226001 PO 00000 Frm 00003 Fmt 4701 Sfmt 4700 E:\FR\FM\[Link] 07DER2
 76544 Federal Register / Vol. 76, No. 235 / Wednesday, December 7, 2011 / Rules and Regulations

While we appreciate the interest in qualified entities. Specifically, it is demonstrate required experience. It is
allowing a variety of organizations to difficult to imagine there will be many essential for the success of the qualified
serve as qualified entities, we believe a areas where multiple organizations will entity program that organizations
provisional track is not consistent with possess sufficient claims data from other approved as qualified entities have the
the requirement in the statute that sources. Additionally, we believe necessary expertise and experience to
entities be qualified, as determined by allowing all eligible organizations to successfully perform all the functions
the Secretary, to use claims data to serve as qualified entities will required in the statute. We believe the
evaluate provider and supplier encourage innovation in measure experience requirements we have
performance. We hope that the development and performance included are sufficient to ensure
discussion above, which notes that reporting. In the case that there are organizations approved as qualified
potential qualified entity applicants multiple organizations in an area that entities possess the necessary
may form contractual agreements to could serve as individual qualified experience to successfully meet the
meet the eligibility requirements, will entities, we would like to reiterate that requirements of the program.
allow entities with less experience or these organizations could form Comment: Commenters suggested
limited other claims data to gain the contractual arrangements with each changes to specific tasks in the
necessary expertise or gather the needed other and apply for the program under organizational and governance
data to be approved as a qualified a lead applicant. capabilities section of the eligibility
entities. We also have added a criteria. Several commenters asked CMS
a. Organizational and Governance to only require expertise in the areas of
conditional approval process, discussed
Capabilities measurement the entity is proposing to
in more detail below, for those
applicants that do not have access to Under organizational and governance use instead of all four areas of
claims data from other sources at the capabilities, we proposed to evaluate measurement: Quality, efficiency,
time of their application. the applicant’s capability to perform a effectiveness, and resource use.
Comment: We received several variety of tasks related to serving as a Similarly, commenters also noted that
comments requesting CMS limit the qualified entity. Tasks included the not all measures require risk-adjustment
organizations eligible to serve as ability to accurately calculate measures and requested CMS only require
qualified entities to non-profit and from claims data, successfully combine experience in risk-adjustment if the
government organizations. However, we claims data from different payers, entity is planning on using measures
also received comments asking CMS to design performance reports, prepare an that incorporate risk-adjustment.
continue to allow any organization that understandable description of measures, Commenters also recommended
meets the eligibility requirements and implement a report review process for removing the requirement that
submits an application to serve as a providers and suppliers, maintain a organizations have experience
qualified entity. rigorous data privacy and security successfully combining claims data
Response: On balance, we believe it is program, and make reports containing from different payers, arguing that this
appropriate for CMS to continue to provider and supplier level data requirement would necessitate that
allow any organization that meets the available to the public. We proposed to applicants currently have data from two
eligibility requirements and the generally require applicants to or more payers other than Medicare.
requirements at sections §§ 401.703– demonstrate expertise and sustained Response: We agree with commenters
401.710 of the proposed rule to serve as experience on each of the criteria, about the proposal that would have
a qualified entity, which appear, as which could be demonstrated by three required expertise in all four areas of
modified in the following discussion, in or more years of experience in each measurement. As a result, we are
sections §§ 401.705–401.721 of this final area. We also proposed to consider modifying the eligibility requirements
rule. applications with fewer years related to these areas of performance
Comment: While we received several experience handling claims data and measurement and will require all
comments supporting our proposal not calculating measures, and/or limited applicants to have experience
to limit the number of qualified entities experience implementing or calculating quality measures, and, to the
in a geographic region, we also received maintaining a report review process for extent that they propose using such
comments suggesting we limit the providers and suppliers as long as the measures, experience calculating
number of qualified entities eligible to applicant has sufficient experience in efficiency, effectiveness and resource
serve in an area. Many of those who all other areas. use measures. Similarly, we will only
suggested limiting the number of Comment: Commenters had mixed require entities to have experience with
qualified entities in an area expressed opinions about the proposed risk-adjustment, if they propose using
concern that allowing multiple qualified requirement of three or more years of measures requiring risk adjustment.
entities in a region would lead to experience. Commenters who did not Finally, the law requires that a qualified
multiple reports on the same provider or support a minimum three years entity combine data from different
supplier, which would confuse both the experience were concerned about payers, so we will retain that
individual or entity being measured and limiting eligibility of otherwise viable requirement in this final rule.
the consumer. One commenter entities. On the other hand, commenters Comment: One commenter requested
suggested CMS take a phased approach who strongly supported the eligibility that CMS only approve applicants with
to the number of qualified entities, criteria suggested lengthening the time a demonstrated track record of working
allowing providers to get accustomed to requirement to five years. with providers and suppliers and
measurement before expanding the Response: While we are sensitive to helping them with quality
emcdonald on DSK5VPTVN1PROD with RULES2

number of qualified entities. the desire to allow all interested improvement.

Response: We acknowledge organizations to serve as qualified Response: While we hope this
commenters’ desire to limit the number entities, we believe that many viable program will support quality
of reports on a provider or supplier; entities will possess three years of improvement efforts, the statute only
however, we do not anticipate many experience, particularly now that we requires qualified entities to
regions will have multiple entities that have clarified that a qualified entity may confidentially make reports available
meet the requirements to serve as contract with other entities in order to prior to publication and to allow

VerDate Mar<15>2010 17:17 Dec 06, 2011 Jkt 226001 PO 00000 Frm 00004 Fmt 4701 Sfmt 4700 E:\FR\FM\[Link] 07DER2
 Federal Register / Vol. 76, No. 235 / Wednesday, December 7, 2011 / Rules and Regulations 76545

providers and suppliers the opportunity we also proposed to require qualified records. We proposed to require entities
to request error correction. We believe entities to submit a business model for to demonstrate to CMS that the other
that our requirement that applicants covering the cost of required functions. claims data they possess is sufficient to
submit documentation of experience in Comment: Some commenters argued address issues of sample size and
both maintaining a process for providers that requiring prospective applicants to reliability expressed by stakeholders
and suppliers to review their reports submit a business model is too regarding the calculation of performance
prior to publication, and providing prescriptive, while others were measures from a single payer source. We
timely response to requests for error supportive of this requirement. A also requested comment on whether
correction will be adequate to ensure an handful of commenters asked CMS for CMS should require entities to possess
applicant’s ability to work with guidance on financing mechanisms, as claims data from two or more other
providers and suppliers to ensure the well as whether they could change a fee sources to be eligible to serve as a
availability of reports and appropriate for the reports or license the data for qualified entity.
correction mechanisms. secondary use. Comments: Some commenters were
Comment: We received several Response: In requiring submission of supportive of the requirement that
comments on our proposal to require a business model, it was not our intent entities possess claims data from other
applicants to disclose inappropriate to be overly prescriptive. Rather, we sources at the time of application, but
disclosures of beneficiary identifiable were seeking to ensure that the qualified others argued that this requirement is
information. Specifically, one entities would have the resources too restrictive and not consistent with
commenter suggested that requiring necessary to carry out what we expect the intent of the statute. Specifically,
disclosure of a 10-year privacy breach would be a relatively resource-intensive commenters argued that it might be
history is unreasonable. Another and important undertaking. We expect difficult to acquire claims data from
commenter requested that CMS include that by requiring submission of a other sources without approval from
a requirement that applicants disclose business plan qualified entities would CMS to serve as a qualified entity. Other
confirmed violations of State privacy be more likely to have a viable business commenters sought clarification on
laws, in addition to inappropriate model under which they would be able whether qualified entities had to
disclosures of beneficiary identifiable to carry out their obligations under the physically possess claims data from
information. qualified entity program. We do not other sources or whether agreements
Response: We believe that requiring intend to limit an organization’s ability with owners of claims data from other
an applicant to disclose 10 years’ worth to change or adapt its business plan sources and proof of a functioning
of inappropriate disclosures of once approved as a qualified entity. We distributed data approach, meaning that
beneficiary information is a reasonable only ask that the qualified entity claims data from different sources
requirement, but we recognize that some demonstrate that it has thought through residing at different physical locations
applicants may not have a 10 year what it would need to do to succeed. as long as measure results could be
history. For those entities that do not Finally, as for financing mechanisms, securely and accurately aggregated,
have a 10 year history, we will require we note that the qualified entity would suffice.
reporting the required information for program regulations do not generally Response: While most organizations
the length of time the organization has place any added limitations on what is that are experienced in performance
been in existence. We clarify, however, otherwise feasible under applicable measurement will already have claims
that a qualified entity’s application to laws. For example, the content of the data they are using for performance
receive Medicare data will be evaluated publicly released reports will be subject measurement, we understand
based on all of the information to existing laws on copyright. Qualified commenters’ concerns about the
submitted; a past inappropriate entities cannot, however, charge requirement that entities possess claims
disclosure of beneficiary identifiable providers or suppliers for the data from other sources at the time of
information will not automatically confidential copies of the pre- application. Therefore, for those
disqualify an entity from participation publication reports that qualified applicants that do not have access to
in the program. If an entity’s application entities are required to provide in other claims data at the time of their
lists these events, CMS will engage in advance of publication. Furthermore, application, we will create a conditional
further discussions with that applicant qualified entities must publically report approval process. First, applicants that
to determine what corrective processes measure results free of charge and in a are found to meet all the requirements
the entity has put in place to avoid manner that is consistent with the of the program, but do not have access
future inappropriate disclosure of requirements in Section 1874(e)(4)(C) of to other claims data at the time of their
beneficiary identifiable information. We the Act. We encourage qualified entities application, will receive a conditional
agree that violations of State, as well as to be innovative in creating business acceptance. Then, once an entity with a
federal, privacy and security laws models to support their efforts. conditional acceptance gets access to
should also be submitted to CMS and adequate claims data from other
will add this requirement to the b. Addition of Claims Data From Other sources, it will submit documentation
eligibility criteria. For clarity, we have Sources that the claims data from other sources
rephrased the proposed language in In accordance with the statutory that it intends to combine with the
§ 410.705(a)(1)(vii) that referred to requirements at section Medicare data received under this
violations of State privacy laws or 1874(e)(4)(B)(iii), we proposed to subpart address the methodological
HIPAA violations to read ‘‘violations of require entities to have claims data from concerns regarding sample size and
applicable federal and State privacy and non-title 18 (Medicare) sources to reliability that have been expressed by
emcdonald on DSK5VPTVN1PROD with RULES2

security laws and regulations’’ to combine with Medicare data. We stakeholders regarding the calculation of
encompass the full range of information proposed to require possession of such performance measures from a single
privacy and security laws and other data at the time of their payer source. CMS will review the
regulations at both the federal and State application. We defined claims data as documentation and if the amount of
levels with which the applicant may administrative claims, meaning data other claims data is found to be
have to comply. In addition to that is not chart-abstracted data, registry sufficient, the entity will pay a fee equal
demonstrating experience and expertise, data, or data from electronic health to the cost of CMS making the data

VerDate Mar<15>2010 17:17 Dec 06, 2011 Jkt 226001 PO 00000 Frm 00005 Fmt 4701 Sfmt 4700 E:\FR\FM\[Link] 07DER2
 76546 Federal Register / Vol. 76, No. 235 / Wednesday, December 7, 2011 / Rules and Regulations

available and execute a Data Use other claims data is combined with as a qualified entity. However, we
Agreement (DUA) with CMS to be Medicare data, it covers a considerable recognize commenters’ desire to ensure
approved as a qualified entity. A portion of a provider’s or supplier’s measures and report formats are
conditionally approved qualified entity patients. We will therefore not require approved and available for use as
will not be eligible to receive Medicare an applicant to have two sources of quickly as possible. Therefore, we will
claims data or the beneficiary crosswalk additional claims data, but we note that change the timeframe for CMS approval
(discussed further in Section D.1) until claims data from two or more sources is to 30 days. Qualified entities may
it has received full approval, pays a fee preferable to data from only one other change selected measures, and may
equal to the cost of making the data source. We acknowledge that it is modify their report prototype, with 30
available, and signs a DUA. important for the combined data to days notice to CMS and CMS approval
This conditional approval process represent a large portion of a provider’s of the changes or modifications. We
will be in addition to the normal business, but believe an arbitrary believe that the majority of changes
approval process that will remain in requirement of 90 percent is proposed by qualified entities will be
place for those applicants that have unnecessarily high, especially given that straightforward and CMS will be able to
access to a sufficient amount of other the program is just beginning. comfortably conduct a review and
claims data at the time of their approval within 30 days of submission;
application. Additionally, we want to c. Data Privacy and Security
however, in certain circumstances CMS
clarify that distributed data approaches, We proposed to require applicants to may request an additional 30 days to
as described above, are permissible demonstrate their capabilities to approve more wide-reaching changes or
under the scope of this program. establish, maintain, and monitor a modifications. If a CMS decision on
Comment: We received several rigorous privacy and security program, approval or disapproval for a change or
comments asking CMS to clarify the including programs to educate staff on modification is not forthcoming within
amount of other claims data applicants privacy and data security protocols. 30 days and CMS does not request an
must possess. Commenters also asked if Comments related to the proposed additional 30 days for review, the
CMS would consider Medicaid data to data privacy and security eligibility change or modification shall be deemed
be other claims data. criteria requirements are covered in the to be approved.
Response: As stated in the proposed Data Security and Privacy section below We acknowledge the interest in only
rule, we do not believe it is feasible to in section II.D. of this final rule. requiring CMS approval for substantive
establish an absolute threshold for a changes in the prototype reports.
3. Operating and Governance
minimum amount of additional claims However, as it is the first year of the
Requirements for Serving as a Qualified
data. Rather, we ask applicants to program, we are still determining the
explain how the data they do have for Entity
types of changes to the prototype reports
use in the qualified entity program will We require documentation of that qualified entities will need to
be adequate to address the concerns operating and governance requirements submit to CMS for approval. CMS is
about small sample size and reliability at the time of application for several key considering releasing guidance on the
that have been expressed by activities. We proposed that applicants types of changes to the report prototype
stakeholders regarding the calculation of would submit as part of their that need not be submitted once the
performance measures from a single application: (1) The measures they qualified entity program has started.
payer source. Each application will be intend to use, including methodologies We agree with commenters that
evaluated on its collective merits, and a rationale for using the measure; including standard measure
including the amount of claims data (2) the report review process they would specifications is unnecessary. Thus far,
from other sources and its explanation use with providers and suppliers, available standard measures only
on why that data, in combination with including addressing requests for data include measures endorsed by the
the requested Medicare data, is adequate and error correction; and (3) a prototype National Quality Forum and CMS
for the stated purposes of this program. for required reports, including the measures; and the specifications for
‘‘Other claims data’’ can include methods for disseminating reports. these measures are available to the
Medicaid data as well as any private Comments: We received several public. Therefore, we will only require
payer claims data. comments that the submission of applicants to include measure
Comment: We also received mixed measures and methodologies, as well as specifications for alternative measures.
comments on our proposal to require a prototype for reports at the time of We will use future rulemaking to
organizations to have two or more data application is too burdensome. address the submission of specifications
sources at the time of application. Some Additionally, commenters argued that for standard measures if the public
commenters said this requirement 90 days notice for approval of changes availability of standard measure
seemed appropriate, while others was too long and that certain types of specifications changes in the future.
argued it was too burdensome. One minor changes to the report prototype Comment: One commenter requested
commenter argued that unless combined need not trigger CMS approval. Several that CMS require each applicant to
data represents at least 90 percent of a commenters also argued that submitting submit an analytic plan clarifying its
provider’s practice, any resulting quality specifications on standard measures is goals relative to the statute.
measurements will not be meaningful. unnecessary since these measures have Response: We believe that the
Response: We based our proposal established specifications and are requirement for entities to submit a
about acquiring data from two or more generally publically available. rationale for selecting each measure,
sources on the interests of providers, Response: We understand including its relationship to existing
emcdonald on DSK5VPTVN1PROD with RULES2

suppliers, and consumers to have organizations’ desire to have flexibility measurement efforts, addresses the issue
reports that provide valid results that in selecting measures and report of an organization’s goals as they relate
cover an adequate portion of the formats. We also believe that making to the statute. We believe this is
providers’ or suppliers’ patients. these decisions is a key aspect of serving sufficient documentation of an
However, in certain cases, one source as a qualified entity and is important organization’s plans.
may provide a sufficient amount of enough to require the submission of Comment: One commenter requested
other claims data such that, when the proposed plans prior to being approved that CMS require applicants to submit

VerDate Mar<15>2010 17:17 Dec 06, 2011 Jkt 226001 PO 00000 Frm 00006 Fmt 4701 Sfmt 4700 E:\FR\FM\[Link] 07DER2
 Federal Register / Vol. 76, No. 235 / Wednesday, December 7, 2011 / Rules and Regulations 76547

conflict of interest information. Comment: Some commenters stakeholders before calculating and
Commenters were concerned that suggested that qualified entities be reporting alternative measures.
conflicts of interest could result in allowed to calculate measures that are However, other commenters argued that
inaccurate or misleading reporting. One not based solely on claims data. the notice and comment rulemaking
commenter specifically requested that Specifically, commenters were process provided appropriate safeguards
qualified entities be required to attest interested in calculating measures that against the public reporting of untested
that they have no relationship or involve combining claims data with measures.
affiliation with any health plans, clinical data (for example, registry data Response: We believe that the intent
insurers, providers, suppliers, or chart-abstracted data). Commenters of the alternative measure provision in
manufacturers or other entities that may argued that allowing qualified entities to statute is to promote innovation in
have an interest in or use for the data. use these measures would expand the claims-based performance
Response: We do not believe it is list of available measures. Several measurement, while ensuring that
necessary for applicants to submit commenters also expressed that the use measures are not used in the qualified
information on conflicts of interest to of these types of measures would help entity program without proper testing
CMS. We expect that many qualified produce a more accurate picture of and validation. That said, in light of the
entities will have relationships with provider and supplier performance. comments received, we believe that
health plans, insurers, providers and Response: We recognize commenters’ greater flexibility could be afforded to
suppliers, and other entities that have desire to use clinical data combined qualified entities to better balance
an interest in or use for the data in order with claims data when calculating innovation with appropriate use. We are
to meet the requirements of the standard and alternative measures. therefore adding additional flexibility
qualified entity program, such as Given the added value that clinical data into the alternative measure process by
obtaining other claims data or brings to performance measurement, adding a second avenue by which to
disseminating performance results. We whenever standard or alternative seek Secretarial approval of alternative
believe the eligibility requirements and measures provide for the use of clinical measures. In order to receive approval
monitoring requirements will ensure data, we will allow qualified entities to to use an alternative measure under this
that the organizations who serve as use clinical data in combination with new avenue, a qualified entity will need
qualified entities comply with the Medicare and other claims data to to submit documentation to CMS
requirements of the program. calculate those standard and alternative outlining consultation and agreement
measures. We have added a definition of with stakeholders in the geographic
B. Definition, Selection, and Use of clinical data at § 401.703(i), specifically region the qualified entity serves, and
Performance Measures clinical data is registry data, chart- evidence that the measure is ‘‘more
1. Standard and Alternative Measures abstracted data, laboratory results, valid, reliable, responsive to consumer
electronic health record information, or preferences, cost-effective, or relevant to
The statute permits qualified entities other information relating to the care or dimensions of quality and resource use
to use both standard and alternative services provided to patients that is not not addressed by such standard
measures. We proposed to define included in administrative claims data. measures’’ in accordance with the
standard measures as any claims-based Measurement efforts using clinical data statutory requirements at Section
measure endorsed (or time-limited would only be supported under the 1874(e)(4)(B)(ii)(II). Stakeholders must
endorsed) by the entity with a contract qualified entity program if the clinical include a valid cross representation of
under section 1890(a) of the Act data is combined with the qualified providers, suppliers, employers, payers,
(currently the National Quality Forum), entity’s Medicare and other claims data and consumers. At a minimum, a
any claims-based measure that is to calculate the measures. These qualified entity must submit:
currently being used in a CMS program regulations do not address the use and • A description of the process by
that includes quality measurement, or publication of purely clinical-based which the qualified entity notified
any measure developed pursuant to measures. stakeholders of its intent to seek
Section 931 of the Public Health Service Furthermore, we recognize the near approval of an alternative measure.
Act. The statute requires the Secretary impossibility of combining Medicare • A list of stakeholders from whom
to consult with appropriate stakeholders claims data with clinical data without feedback was solicited, including the
as to whether the use of alternative an identifier to link them. As a result, stakeholder names and each
measures would be more valid, reliable, we are changing the proposed process stakeholder’s role in the community.
responsive to consumer preferences, for releasing beneficiary identifiable • A description of the discussion
cost-effective, or relevant to dimensions information to allow—with strict about the proposed alternative measure,
of quality and resource use not privacy and security standards—for the including a summary of all pertinent
addressed by standard measures. In disclosure of identifiers to qualified arguments for and against use of the
light of these requirements, we entities; this change is discussed in measure.
proposed to define alternative measures more detail in the Privacy and Security • An explanation backed by scientific
as any claims-based measure that, while requirements section below. evidence that demonstrates why the
not a standard measure, was adopted by Comment: Many commenters were measure is ‘‘more valid, reliable,
the Secretary through a notice and supportive of the alternative measure responsive to consumer preferences,
comment rulemaking process. Qualified review process. However, several cost-effective, or relevant to dimensions
entities would submit proposed commenters argued that the notice and of quality and resource use not
alternative measures to CMS who would comment rulemaking process was addressed by [a] standard measure.’’
emcdonald on DSK5VPTVN1PROD with RULES2

then make the proposed alternative overly burdensome on qualified entities, CMS will review the submission and
measures available for stakeholder input would significantly restrict innovation make a decision as to whether the
via a proposed rule, and, where in measure development and use, and qualified entity has consulted the
appropriate, following receipt of public was contrary to the overall goals of the appropriate stakeholders and whether
comments, the Secretary would provision. Some commenters proposed the new measure meets the
determine which alternative measures that qualified entities only be required requirements for alternative measures at
to approve for use in the program. to seek the permission of local Section 1874(e)(4)(B)(ii)(II) of the Act.

VerDate Mar<15>2010 17:17 Dec 06, 2011 Jkt 226001 PO 00000 Frm 00007 Fmt 4701 Sfmt 4700 E:\FR\FM\[Link] 07DER2
 76548 Federal Register / Vol. 76, No. 235 / Wednesday, December 7, 2011 / Rules and Regulations

Qualified entities must send all the research and provide that new scientific standard measures be limited to true
information required for approval of an evidence to CMS. outcome measures in order to measure
alternative measure to CMS at least 60 We will also retain the notice and the effectiveness of care.
days prior to its intended use of the comment rulemaking process as a Response: We appreciate the
measure. CMS will make every effort to second option for the approval of suggestion to include measures
ensure that measures are approved alternative measures. As discussed in endorsed by consensus-based entities
during the 60 day period. If a CMS the proposed rule, alternative measures other than the NQF and have changed
decision on approval or disapproval for approved through notice and comment our definition of standard measures to
an alternative measure is not rulemaking may be used by any include such measures. Specifically, we
forthcoming within 60 days, the qualified entity up until the point that will now include as a standard measure
measure shall be deemed to be an equivalent standard measure for the any measure calculated in full or in part
approved. However, CMS retains the particular clinical area or condition from claims data that is endorsed by a
right to disapprove a measure if, even becomes available. consensus-based entity, providing that
after 60 days, in accordance with the Comment: One commenter suggested the consensus-based entity has been
statutory requirements at Section that the alternative measure process as approved as such by CMS. Rather than
1874(e)(4)(B)(ii)(II) it is found to not be outlined conflicted with the process defining consensus-based entities in
‘‘more valid, reliable, responsive to under Section 3014 of the Affordable advance, CMS will approve
consumer preferences, cost-effective, or Care Act. organizations as consensus based
relevant to dimensions of quality and Response: Section 1874(e)(4)(B)(ii)(I) entities on an as needed basis.
resource’’ than a standard measure. provides for the use of standard To receive approval as a consensus-
Once a measure is approved CMS will measures such as the measures based entity, an organization will need
release the name of the measure, as well endorsed by the entity with a contract to submit information to CMS
as the scientific evidence that under section 1890(a) of the Act documenting their processes for
demonstrates why the measure is ‘‘more (currently NQF) and measures stakeholder consultation and measure
developed pursuant to section 931 of approval. Such documentation must
valid, reliable, responsive to consumer
the Public Health Service Act. Section show that the entity has a prescribed
preferences, cost-effective, or relevant to
1874(e)(4)(B)(ii)(II) provides for use of process for vetting and approving
dimensions of quality and resource use
additional measures that are not measures that includes representation
not addressed by [a] standard measure.’’
approved by such entities. This latter from all types of stakeholders relevant
Alternative measures submitted and category explicitly provides for the to the topic being measured. The
approved using this process may only approval and use of non-NQF standards. description of the approval process
be used by the qualified entity that Furthermore, section 3014 of the must be publicly available and the
submitted the measure for consideration Affordable Care Act does not require the stakeholder consultation must be open
because the stakeholder consultation Secretary to use the recognized to any that are interested in
approval process only requires standards by the entity with a contract participating. Additionally,
consultation with stakeholders in the under section 1890(a) of the Act. It organizations will only receive approval
geographic region the qualified entity merely serves to provide as a consensus-based entity if all
serves. If another qualified entity wishes recommendations on appropriate measure specifications are publicly
to use the same measure, it would need standards to consider. available. Consensus-based entities will
to consult with stakeholders in its own Comment: Several commenters receive approval for a time period of
community, and submit its own request questioned whether the requirement for three years and their endorsed measures
for alternative measure approval under qualified entities to cease using will be made available to all qualified
the rulemaking or stakeholder alternative measures within six months entities. CMS will also make a list of
consultation approval process. of an equivalent standard measure being approved consensus-based entities
However, we recognize that scientific endorsed was reasonable. available publicly. After three years,
evidence demonstrating that the Response: We believe six months is a organizations will simply have to
measure is ‘‘more valid, reliable, reasonable time period for qualified resubmit documentation on their
responsive to consumer preferences, entities to transition to using newly processes for stakeholder consultation
cost-effective, or relevant to dimensions endorsed standard measures equivalent and measure again, noting any changes
of quality and resource use not to existing alternative measures or to from their original submission.
addressed by [a] standard measure’’ will submit scientific justification to file a Regarding the request that we add a
not differ for a measure in use across request for alternative measure requirement that standard measures be
communities. Therefore, once an approval. ‘‘outcome measures,’’ which we
alternative measure is approved for use Comment: We received several understand to mean measures that
via the stakeholder consultation comments on our definition of standard evaluate final results, such as mortality
approval process, future requests for use measures. While many commenters rates, we feel that imposing this
of an identical measure will not need to were supportive of our definition, one requirement would substantially reduce
include the same explanation backed by commenter suggested that we change the number of available standard
scientific evidence that demonstrates our definition of standard measures to measures. Additionally, while we agree
why the measure is ‘‘more valid, include measures endorsed by that outcome measures may be better
reliable, responsive to consumer consensus-based entities other than the indicators of the effectiveness of care,
preferences, cost-effective, or relevant to NQF. The commenter specifically we feel process measures will also offer
emcdonald on DSK5VPTVN1PROD with RULES2

dimensions of quality and resource use mentioned the Patient Charter, a 2008 the public, as well as providers and
not addressed by [a] standard measure.’’ agreement among consumer, purchaser, suppliers, important information on
However, if there is scientific evidence provider and insurer groups on performance. Therefore, we have not
that has become available since the principles to guide performance incorporated this suggestion.
measure was approved by CMS, the reporting. Other commenters asked if all Comment: One commenter suggested
qualified entity seeking to use that NQF-endorsed measures were standard that the rule should permit the use of
measure must conduct the necessary measures. One commenter asked that composite measures.

VerDate Mar<15>2010 17:17 Dec 06, 2011 Jkt 226001 PO 00000 Frm 00008 Fmt 4701 Sfmt 4700 E:\FR\FM\[Link] 07DER2
 Federal Register / Vol. 76, No. 235 / Wednesday, December 7, 2011 / Rules and Regulations 76549

Response: We believe that composite evaluate the performance of providers process is warranted. The Trade Secrets
measures can be calculated and reported and suppliers. The proposed rule would Act (18 U.S.C. 1905) bars CMS from re-
under the revised alternative measure also require qualified entities to include disclosing proprietary information
process we established in this final rule. an understandable description of their unless it is authorized to do so by law.
Comment: One commenter suggested attribution, risk adjustment, and Any disclosure to CMS regarding
that the rule should permit qualified benchmarking methods so that report measurement methodologies or
entities to withdraw measures prior to recipients can properly assess such specifications will generally not be
public reporting if the measure results reports. We agree with commenters that made public by CMS. As a result, we
turn out to be unreliable. payment standardization is an feel it is appropriate to require the
Response: We appreciate this important aspect of measurement disclosure of detailed methodologies
suggestion; however, the statute requires methodologies, and agree that payment and specifications for alternative
public reporting of all measures. standardization methodologies should measures to CMS as part of the
Specifically, Section 1874(e)(4)(C)(iv) be included where appropriate. application.
requires the reports be made available to Therefore, we have added a requirement Additionally, qualified entities will be
the public, while allowing for that qualified entities include required to disclose proprietary measure
confidential review by providers and information on payment standardization methodologies to providers and
suppliers. We note that this does not when appropriate. suppliers as a part of the confidential
prohibit commentary on the measure Additionally, we feel that review process. We believe it is
and results in the report. We hope that performance measurement is evolving, essential for providers and suppliers to
qualified entities will take the and that clear standards for attribution, understand exactly how the measure is
requirement of public reporting into risk adjustment, and benchmarking have calculated in order to review their
consideration when determining which not yet emerged, and therefore it would results. To protect proprietary
measures should be calculated under be inappropriate for CMS to methodologies, a qualified entity may
this program. We recognize that there preemptively determine such standards. choose to limit further disclosure of
may be errors in measure calculation We are confident that as qualified proprietary measure methodologies,
and believe that the confidential entities and the performance perhaps by requiring a provider or
reporting and appeals process will help measurement environment matures over supplier to execute a non-disclosure
qualified entities discover and correct the coming years methodologies will agreement as a condition of that
any errors in the calculation of begin to coalesce around clearly defined disclosure; however, the qualified entity
measures. standards. As discussed above, qualified
Comment: We received a variety of must share the proprietary measure
entities can change methodologies methodologies with the provider or
comments on measurement during the three year agreement period
methodologies. Several commenters supplier regardless of whether they are
provided they give appropriate notice to willing to execute a non-disclosure
suggested that CMS should be more CMS and receive CMS’ approval.
proscriptive regarding the types of agreement. If a qualified entity does not
Regarding outliers, we feel that this
attribution, risk adjustment, and wish to share proprietary measure
issue will be adequately addressed in
benchmarking methods qualified methodologies with both CMS and
the requirements at § 401.707(b)(5)(ii)
entities should employ and that providers or suppliers, it should not
for a qualified entity to provide details
methodology descriptions should be seek approval to use those measures in
on methodologies it intends to use in
standardized across payers and the qualified entity program.
creating reports with respect to
qualified entities. Commenters were benchmarking performance data, Comment: One commenter suggested
also concerned about payment including methods for creating peer that all proposed measures, both
standardization as it relates to efficiency groups, justification of minimum standard and alternative, be open for
and resource use measures. Payment sample size determinations, and public review by providers and
standardization is viewed as an methods for handling statistical outliers, suppliers prior to approval.
important methodological approach to to both CMS and users of the reports. Response: We do not feel that this
normalize comparisons of resource use Comment: One commenter asked requirement is necessary. Standard
across providers and suppliers. Several about the release of the details of measures as currently defined have
commenters also stressed the need for proprietary methodologies and already been subject to multi
accurate attribution and risk adjustment proprietary measure specifications to stakeholder input and approval either
in general. One commenter asked if CMS. through the entity with a contract under
methodologies employed by the Response: While we understand the section 1890(a) of the Act (currently
qualified entity could change during the concerns about releasing methodologies NQF) or through public comment via
three-year agreement period. One for proprietary measures, we believe notice and comment rulemaking in the
commenter urged CMS to require that the goal of this program is to case of CMS measures. Also, any
qualified entities to submit to CMS a increase transparency. As discussed measures developed by a consensus
specific description of how it will above in section II.A.3., we are not based entity will have gone through
handle outlier providers and ensure that requiring qualified entities to submit some form of stakeholder consultation.
a report of a provider’s or supplier’s measure specifications for standard Thus far, there have been no measures
performance is accurately adjusted as measures because, thus far, all developed pursuant to section 931 of
appropriate to reflect characteristics of specifications for these measures are the Public Health Service Act; however,
the patient population. available to the public. However, we section 931 requires consultation with
emcdonald on DSK5VPTVN1PROD with RULES2

Response: The statute does not believe that, in order for CMS to stakeholders during the quality measure
require CMS to be proscriptive in this evaluate a qualified entity’s proposed development process. Further, both of
regard. Consistent with the statute, the plan for calculating measures, the alternative measure processes
proposed rule would require qualified disclosure of proprietary measure include requirements regarding
entities to submit to the Secretary a methodologies and proprietary stakeholder input.
description of methodologies that the specifications for alternative measures Comment: Several commenters urged
qualified entity proposes to use to to CMS as part of the application CMS to provide a comprehensive list of

VerDate Mar<15>2010 17:17 Dec 06, 2011 Jkt 226001 PO 00000 Frm 00009 Fmt 4701 Sfmt 4700 E:\FR\FM\[Link] 07DER2
 76550 Federal Register / Vol. 76, No. 235 / Wednesday, December 7, 2011 / Rules and Regulations

the standard and alternative measures generally. One commenter asked that their reports and work through any
that qualified entities may use. qualified entities be required to report issues directly with the qualified entity,
Response: We plan to release a list of less frequently than once per year, as and not with CMS.
standard measures to potential qualified proposed. Other commenters asked that Comment: We received several
entity applicants prior to the start of the qualified entities be required to report comments regarding the provider or
program. We would like to note, more frequently than once per year. Yet supplier’s role in the reporting process.
however, that this list will be dynamic other commenters expressed concern One commenter stated that providers
since the entity with the contract under about public reporting and asked that no and suppliers should be allowed to
section 1890(a) of the Act (currently measurement data be publicly reported petition CMS to require qualified
NQF) is continually reviewing measures at all. entities to modify report formats.
for endorsement and CMS is continually Response: The statute, at Another commenter requested that
undergoing rulemaking to add measures 1874(e)(C)(iv), requires qualified entity qualified entities should be required to
to our programs. Additionally, as new reports to be made available to the include providers’ or suppliers’
consensus based entities are approved public after they are made available to comments in the public reports. And
by CMS, additional standard measures providers and suppliers for review and finally, one commenter requested that
will be available for use by qualified requests for corrections. We have no qualified entities be required to be
entities. We will also release a list of discretion to allow qualified entities to capable of allowing providers and
approved alternative measures once produce reports for confidential use suppliers to download reports
alternative measures are approved. only. While the statute does not electronically.
Qualified entities are encouraged to mention any specific frequency of Response: As stated in the proposed
check these lists frequently to ensure public reporting, we believe that once rule, and discussed elsewhere in this
they have the most accurate information per year is an appropriate requirement. final rule, CMS’ direct role in this
regarding acceptable measures. Requiring public reporting once per year program is relatively limited, and
strikes a balance between reporting includes only the functions necessary
2. Reports and Reporting
frequently enough that the information for reviewing applications from
Section 1874(e)(4)(C)(ii) of the Act is actionable for consumers, and not
requires qualified entities to make their qualified entities and providing
reporting so frequently that providers standardized data extracts to those
draft reports available in a confidential and suppliers constantly have to
manner to providers and suppliers entities that meet the requirements, as
confidentially review reports. However, well as describing the program to the
identified in the reports before such we note that reporting once per year is
reports are released publicly in order to public. We believe these comments
the minimum requirement. A qualified about issues related to how the qualified
offer them an opportunity to review entity may choose to report more
these reports, and, if appropriate, appeal entities publicly report data are outside
frequently than once per year, as long as
to request correction of any errors. After the scope of CMS’ statutory authority
it is still able to meet the requirement
reports have been shared confidentially under section 1874(e). Therefore,
of allowing providers and suppliers the
with providers and suppliers, and there providers and suppliers will not be
opportunity to review and request error
has been an opportunity to have any allowed to petition CMS to change the
correction.
errors corrected, Section Comment: Commenters raised reports, and a qualified entity will
1874(e)(4)(C)(iv) of the Act requires the questions about the possibility of decide itself whether to post comments
reports to be made available to the providers and suppliers receiving in a public report or make its reports
public. multiple reports, which may potentially available for download in an electronic
As stated in the statute at Section contain contradictory or confusing format.
1874(e)(4)(C)(i) of the Act, the reports performance measure results. Some Comment: One commenter noted that
must include ‘‘an understandable commenters requested that CMS the proposed rule could be interpreted
description’’ of the measures, rationale standardize the report formats among as requiring qualified entities to do all
for use, methodology (including risk- qualified entities to make them easier to reporting at the individual physician
adjustment and physician attribution interpret, and others simply asked CMS level. Another commenter noted that, in
methods), data specifications and to clarify how we will address this terms of performance measurement,
limitations, and sponsors. We issue. specialty hospitals need to be accounted
interpreted ‘‘an understandable Response: As discussed in the for differently.
description’’ to mean any descriptions proposed rule and above, we do not Response: The statute does not
that can be easily read and understood intend to limit the number of qualified specify the level at which reports are to
by a lay person. Additionally, the entities accepted for participation into be generated (that is, individual
reports to the public may only include this program, and therefore, it is physician, physician group, integrated
data on providers or suppliers at the possible that there will be more than delivery system, etc.), nor does it
provider or supplier level with no claim one qualified entity working in the same specify the types of providers and
or patient-level information to ensure geographic area. While we are requiring suppliers to be measured. A qualified
beneficiary privacy. qualified entities to submit prototype entity may choose to which providers
We proposed requiring qualified reports for CMS approval before use, we and/or suppliers it will apply measures,
entities to submit prototype reports for do not intend to standardize the reports. and in so doing, for which entities its
both the reports they would send to We believe this program is intended to reports will be generated. Reporting may
providers and suppliers, and the reports supplement measurement activity be at any level for which the measures
emcdonald on DSK5VPTVN1PROD with RULES2

they would release to the public (if they already ongoing at the community level, can be used, but reports must be devoid
are different) in their application, and excessive CMS involvement will of patient identifiers to protect the
including the narrative language they erode the relationships qualified entities identity of the beneficiaries.
plan to use in the reports to describe the either already have, or will develop, Comment: One commenter requested
data and results. with providers and suppliers. This is that CMS require qualified entities to
Comment: We received several precisely why providers and suppliers license or otherwise make available
comments about the reporting process are afforded the opportunity to review quality measures to other entities that

VerDate Mar<15>2010 17:17 Dec 06, 2011 Jkt 226001 PO 00000 Frm 00010 Fmt 4701 Sfmt 4700 E:\FR\FM\[Link] 07DER2
 Federal Register / Vol. 76, No. 235 / Wednesday, December 7, 2011 / Rules and Regulations 76551

have the ability to publish performance and privacy protections, we proposed qualified entities to identify the
measurement information. that all claims files would contain a provider or supplier associated with the
Response: As stated above, these unique encrypted beneficiary claim. Furthermore, given the eligibility
regulations will generally not place any identification (ID) number, rather than requirements described above in Section
added limitations on what is otherwise the actual beneficiary Medicare Health II.A.1.a., we expect approved qualified
feasible under applicable law (such as Insurance Claim Number (HICN). entities to have experience in accurately
copyright law). Qualified entities Comment: We received several identifying a provider or supplier across
cannot, however, charge providers or comments regarding data extract multiple data sources.
suppliers for the confidential pre- structure. A number of commenters As to reporting suspected issues with
publication reports, and they must make requested clarification on how the data CMS data, CMS currently has a process
reports available to the public free of linkage across data sets will be in place for reporting, tracking, and
charge in accordance with section accomplished. Several comments asked resolving potential errors or issues
1874(e)(4)(c)(iv). how qualified entities would identify identified in CMS data. Once approved,
the provider or supplier associated with each qualified entity will receive
C. Data Extraction and Dissemination
a claim. One commenter expressed guidance and training in this area.
Section 1874(e)(3) of the Act requires concern that no accurate or acceptable Comment: Several commenters raised
the Secretary to provide qualified physician contact data base or directory concerns about some of the data
entities with standardized extracts of is currently available on a nationwide elements we proposed to release. A
claims data from Medicare parts A, B, level. An additional comment asked if number of commenters expressed
and D for one or more specified CMS plans to make changes to the data concern on the release of drug cost
geographic areas and time periods. For in the CMS database if a qualified information in the Part D data, as well
Medicare parts A and B, we proposed entity, provider, or supplier determines as the release of Part D plan identifiers.
that these data extracts would include there is an error in the Medicare claims Additionally, a handful of commenters
information from all seven claim types data. suggested that private physician
that are submitted for payment in the Response: CMS understands the financial information contained in the
Medicare Fee-For-Service Program, importance of linking beneficiaries Part B data is protected from disclosure
including both institutional and non- across Medicare data sets in a way that under the Privacy Act.
institutional claims. Institutional claim is secure and protects beneficiaries’ Response: CMS is aware of the
types include inpatient hospital, privacy. All claims files provided to concerns and restrictions on releasing
outpatient hospital, skilled nursing qualified entities will contain a unique certain Part D drug cost information.
facility, home health, and hospice encrypted beneficiary identification Given these concerns, in the files
services, whereas non-institutional number that will allow a qualified entity provided to qualified entities, CMS will
claim types include physician/supplier to link claims for an individual release the Total Drug Cost element,
and durable medical equipment claims. beneficiary across all Medicare claim which is derived from the sum of four
Medicare institutional and non- types and across all years. That is, a elements: Ingredient Cost, Dispensing
institutional claims include, but are not unique encrypted beneficiary ID number Fee, Vaccine Administration Fee, and
limited to, the following data elements: will be assigned to an individual Total Amount Attributable to Sales Tax.
Beneficiary ID, claim ID, the start and beneficiary and will remain the same for However, to protect the Part D plans’
end dates of service, the provider or that individual beneficiary across proprietary cost information, these
supplier ID, the principal procedure and Medicare claim types and years. This individual component costs will not be
diagnosis codes, the attending encrypted beneficiary ID is unique to released. We believe the aggregation of
physician, other physicians, and the the qualified entity program and will be cost information will help to ensure that
claim payment type. included on each file the qualified the most confidential information—the
We proposed that qualified entities entity receives. With appropriate separate amounts paid by Part D
would also receive certain Part D security and privacy protections, these sponsors for ingredient cost or
information for beneficiaries enrolled in files will also contain beneficiary date of dispensing fee—will not be released.
the Medicare Fee-For-Service Program. birth, race, and gender, important This approach is also consistent with
The Part D information is known as elements for calculating performance the treatment of these data under the
‘‘drug event’’ information, as opposed to measures. regulations governing the use and
‘‘claims’’ information, because Additionally, to allow qualified disclosure of Part D data for non-
prescription drug coverage under Part D entities to identify the provider or payment related purposes. See 73 FR
is provided by private insurance plans supplier associated with a claim, the 30,664, 30669 (May 28, 2008).
or ‘‘Part D plan sponsors.’’ Part D plans files will contain the actual provider or Furthermore, the Part D data will not
are responsible for paying a claim for supplier ID or, where required by law, identify individual Part D plans, but
benefits at the pharmacy. The Part D the National Provider Identifier (NPI). will include an encrypted plan ID
plan then submits a Prescription Drug Although, in HIPAA standard number. We believe this encryption will
Event record or ‘‘PDE’’ to CMS. The key transactions the NPI must be used in afford further protection for Part D drug
data elements in the Part D prescription lieu of other provider numbers, CMS cost information.
drug event database include: Beneficiary will also make the Unique Physician While certain physician payment
ID, prescriber ID, drug service date, drug Identification Number (UPIN) associated information contained in the Part B
product service ID, quantity dispensed, with the claim available to qualified claims data is protected from disclosure
days’ supply, gross drug cost, brand entities. CMS maintains both a to the general public by court
emcdonald on DSK5VPTVN1PROD with RULES2

name, generic name, and drug strength. publically available query-only database injunctions entered in Florida Medical
CMS will also include an indication if and a publically available downloadable Association, Inc. v. Department of
the drug is on the formulary of the Part file that links the NPI to other Health, Education & Welfare, 479 F.
D plan. information on a provider such as the Supp. 1291 (M.D. Fla. 1979), and
In order to allow qualified entities to provider name and mailing address. We American Ass’n of Councils of Medical
link Medicare claims for an individual believe that this national-level database Staffs of Private Hospitals, Inc. v. Health
beneficiary, with appropriate security and downloadable file will allow Care Financing Administration, No. 78–

VerDate Mar<15>2010 17:17 Dec 06, 2011 Jkt 226001 PO 00000 Frm 00011 Fmt 4701 Sfmt 4700 E:\FR\FM\[Link] 07DER2
 76552 Federal Register / Vol. 76, No. 235 / Wednesday, December 7, 2011 / Rules and Regulations

1373 (E.D. La 1980), that protection is 2011. Then, we would provide quarterly Response: We will release claims
specific to disclosures under the data updates on a rolling basis. based on the location of the beneficiary
Freedom of Information Act (FOIA) residence, not the location of the
2. Geographic Areas
exception to the Privacy Act at 5 U.S.C. provider or supplier rendering the
552a(b)(2). Disclosures made under the CMS proposed to provide qualified services. This will mean the qualified
qualified entity program under section entities with standardized data extracts entity might not receive all of the
1874(e) of the Act are not FOIA-based for either a single geographic area or Medicare claims for a given provider or
disclosures. Rather, they are ‘‘routine multiple regions, and to limit the supplier.
use’’ disclosures from the National provision of Medicare data to the While we recognize the desire to
Claims History (NCH)—System No. 09– geographic spread of the qualified calculate performance measures for
70–0558, Medicare Drug Data entity’s other claims data. In the areas outside the geographic spread of
Processing System (DDPS)—System No. proposed rule, we sought comment on the qualified entity’s other claims data,
09–70–0553, Medicare Integrated Data releasing nationwide extracts of we believe the intent of statute is for
Repository (IDR)—System No. 09–70– Medicare data. qualified entities to combine other
0571, and Chronic Condition Data Comment: Several commenters claims data from an area with Medicare
Repository (CCDR)—System No. 09–70– requested that CMS release nationwide claims data for that same area to
0573 systems of records under the Medicare claims data. Some expected to produce robust and actionable
Privacy Act and these implementing conduct a nationwide performance performance measures for providers,
regulations. As such, they are not review program, but many were suppliers, and consumers.
subject to the injunction. interested in calculating national
benchmarks. Commenters expressed 3. Cost To Obtain Data
Comment: We received a variety of
feelings that national Medicare Section 1874(e)(4)(A) of the Act
comments on technical assistance for
benchmarks would foster greater requires qualified entities to pay a fee
qualified entities. Several commenters
consumer and provider understanding for obtaining the data that is equal to the
asked that CMS provide technical
of local measure results. cost of making such data available. In
assistance, but not include it in the fee Response: For entities interested in the proposed rule CMS interpreted the
charged for the data. Other commenters conducting a nationwide performance cost of making the data available to
suggested that technical assistance review program, we are unsure about include two parts: (1) The cost of
would not be needed. the ability of any one entity to assemble running the qualified entity program,
Response: We plan to provide a sufficient amount of data nationally to including costs for processing
qualified entities with the option to justify a nationwide release of Medicare applications, monitoring qualified
request technical assistance. Since we data. If a qualified entity can entities, and providing technical
are removing all program management demonstrate it has a sufficient amount assistance, and (2) the cost of creating a
costs from the fee we will charge of data nationwide, however, CMS will data set specific to each qualified
qualified entities, see discussion below provide a 100% national extract. entity’s requested geographic area and
at II.C.3., we do not plan to charge for We agree that nationwide data may securely transmitting the data set to the
these services. assist qualified entities in benchmarking qualified entity. We estimated that the
1. Number of Years of Data their results. As a result, qualified approximate cost to provide data for 2.5
entities will be allowed to request a 5% million beneficiaries to a qualified
CMS proposed to provide qualified national sample of Medicare claims for entity would be $200,000.
entities with the most recent three the purposes of calculating national Approximately $75,000 of the $200,000
calendar years of Medicare final action benchmarks. The 5% national sample of is cost of the claims data and
data available at the time the qualified claims will not include a crosswalk to approximately $125,000 is the cost of
entity is approved for participation in beneficiary names and Health Insurance making the data available. We proposed
the program. Claim Numbers, discussed below in that data costs would vary depending on
Comment: Comments from both Section D.1, only the encrypted the amount of data requested.
potential qualified entities and provider beneficiary ID to allow linking across Comment: Many commenters stated
groups raised concerns about the Medicare claims data for measure that CMS was being too broad in our
timeliness of the data. Commenters calculation purposes. Qualified entities interpretation of the statutory
generally requested that CMS release should provide a justification of needing requirement to charge qualified entities
data on a quarterly basis or a rolling a 5% national sample with their request. for the cost of making the data available.
12 month basis, with no more than a We will include a requirement in the Commenters suggested that CMS only
quarterly time lag. One commenter Data Use Agreement (DUA, discussed in charge qualified entities for the cost of
suggested that CMS only provide more detail below) prohibiting qualified generating the data, and not the cost of
qualified entities with two calendar entities from re-identifying claims running the program. The comments
years of data because performance included in the national sample they also noted that high cost would be a
information regarding care provided in receive. Additionally, as these files are barrier to entry for non-profit
2008 is too outdated to be relevant for already in existence because they are organizations and states.
providers or consumers. used for other purposes, we anticipate Response: CMS concurs that there are
Response: We agree with commenters, that the cost of making this data public interests at stake that justify
so we are modifying what we proposed available will be nominal. narrowing the scope of what constitutes
to make more timely data available to Comment: We received several the cost of making this data available.
emcdonald on DSK5VPTVN1PROD with RULES2

qualified entities. CMS will provide comments on how CMS would As such, we will drop the program
qualified entities with the most recent determine which claims apply to a management portion of the costs from
available historical data, which, for certain geographic region. We also what is included in the data fee we will
qualified entities approved at the received comments requesting that CMS charge qualified entities. We have also
beginning of the program, we expect not limit the provision of Medicare data worked to identify several efficiencies
would include data for CY2009, to the geographic spread of the qualified in data preparation and distribution that
CY2010, and the first two quarters of entity’s other claims data. will significantly reduce our initial

VerDate Mar<15>2010 17:17 Dec 06, 2011 Jkt 226001 PO 00000 Frm 00012 Fmt 4701 Sfmt 4700 E:\FR\FM\[Link] 07DER2
 Federal Register / Vol. 76, No. 235 / Wednesday, December 7, 2011 / Rules and Regulations 76553

estimates for data costs. Our initial committed to ensuring the success of establish, maintain, and monitor a
estimates were based on the fee we qualified entities in combining rigorous data privacy and security
charge researchers for similar data. Medicare data with claims data from program, including ensuring
However, because all qualified entities other sources to create comprehensive compliance with submitted plans
will receive a standardized extract of the performance reports for providers and related to the privacy and security of
Medicare data, we will not need to suppliers, CMS is also committed to data. Additionally, we proposed a
address each request for data on an ensuring that the beneficiary-level data requirement that the applicant submit to
individual basis as we do with provided to qualified entities is subject CMS a description of its rigorous data
researchers, thereby significantly to stringent security and privacy privacy and security policies including
reducing the cost of making the data standards throughout all phases of the enforcement mechanisms. As part of
available, particularly the costs of performance measure calculation, their applications, qualified entities will
encrypting the data. confidential reporting, appeal, and also have to explain how they would
We estimate that the total public reporting processes. ensure that only the minimum
approximate costs to provide data for In 2008, we published a regulation to necessary beneficiary identifiable data
2.5 million beneficiaries to qualified permit Part D prescription drug event would be disclosed to the provider or
entities would be $40,000 in the first data to be used for program monitoring, supplier in the event of a request by a
year of the program. We estimate that research, public health, care provider or supplier in the context of a
the cost to provide ten quarters (CY coordination, quality improvement, confidential review of a report, and how
2009, CY 2010, and Q1–Q2 CY2011) of population of personal health records, data would be securely transmitted to
data when the qualified entity is first and other purposes. See 73 FR 30664. the provider or supplier.
approved would be $24,000. Thereafter, We intend to ensure that the release of Comment: Commenters were
in 2012 qualified entities would get 2 Part D prescription drug event data generally supportive of requiring that
additional quarterly updates covering under this program complies with the qualified entities have rigorous data
the remainder of CY 2011, each for a fee requirements in the Part D data privacy and security protocols in place.
of $8,000, bringing the total cost of data regulation, including the minimum Several commenters recommended that
for the first year of the program to necessary data policy, and that qualified CMS require qualified entities to impose
$40,000. After the first year, qualified entities take the necessary steps to the same data and security requirements
entities would get quarterly updates, ensure that any prescription drug event on the qualified entity’s non-Medicare
each for a fee of $8,000, bringing the data released to providers and suppliers claims data as we require on the
total cost to a qualified entity for as part of the review, appeal, and error Medicare claims data. One commenter
subsequent years of the program to correction process are also safeguarded suggested CMS require qualified entities
$32,000. It is important to note that all to ensure the privacy and security of and other non-covered entities (that is,
estimates of data costs are currently beneficiary information. the small fraction of providers who do
predicated on an estimate of 25 Comment: Commenters were not submit claims electronically, and
qualified entities, so if fewer than 25 generally supportive of our intent to are therefore not subject to HIPAA) to
qualified entities are approved, data ensure the privacy and security of enter into business associate agreements
costs per qualified entity will be higher, Medicare data under this program. A with CMS, pursuant to HIPAA.
and conversely, if greater than 25 are few commenters made specific Response: We agree that the integrity
approved, the costs will be lower. suggestions regarding data privacy in of performance measurement depends
Additionally, data costs for qualified general. One commenter suggested we on the integrity of the data, and CMS
entities will vary depending on the clarify the interaction of this program intends to take very seriously its role in
amount of Medicare claims data the and its data privacy and security ensuring qualified entities use Medicare
qualified entity requests (for example, requirements with State data privacy data appropriately. However, we do not
more than one State, or a nationwide laws and specifically requested that have the statutory authority to impose
extract). CMS also reserves the right to CMS promulgate regulations that would specific requirements on qualified
revise the cost of the data if preempt State law. entities with regard to the privacy and
unanticipated expenses are determined Response: On the issue of the security of their non-Medicare claims
in the future. interaction of this program with State data. It is our understanding that
laws, we believe the issuance of organizations will have executed
D. Data Security and Privacy contracts or other agreements with the
universally applicable privacy
The subpart created by these regulations that would preempt State entities from which they receive the
regulations will create a new program laws is outside the scope of the non-Medicare claims data (for example,
that provides for the release of Medicare qualified entity program. Qualified commercial insurance plans) that will
beneficiary level data, with appropriate entities will need to abide by applicable contain the privacy and security
privacy and security protections. We state laws in addition to the requirements regarding that data.
recognize that many qualified entities requirements in this subpart. Similarly, we also cannot prescribe how
will have had many years of experience or where a qualified entity stores its
using claims data to produce 1. Privacy and Security Requirements non-Medicare data.
performance reports on providers and for Qualified Entities We seek to clarify the interaction
suppliers. Additionally, many qualified We proposed to require that qualified between this program and HIPAA. Some
entities will have received data from entities have in place security commenters thought that we could
private health plans through agreements protections for all data released by CMS, address the privacy and security
emcdonald on DSK5VPTVN1PROD with RULES2

that will require that the qualified and any derivative files, including any concerns related to qualified entities
entities observe certain security and Medicare claims data and any and other entities that are not directly
privacy standards. We also recognize beneficiary identifiable data. subject to HIPAA by making them CMS’
that new organizations or combinations We proposed that in order to be business associates (BAs). BAs are
of organizations may want to serve as eligible to apply to receive Medicare persons who or entities that use or
qualified entities to produce data as a qualified entity, the applicant disclose individually identifiable health
performance reports. While CMS is must demonstrate its capabilities to information in conducting functions or

VerDate Mar<15>2010 17:17 Dec 06, 2011 Jkt 226001 PO 00000 Frm 00013 Fmt 4701 Sfmt 4700 E:\FR\FM\[Link] 07DER2
 76554 Federal Register / Vol. 76, No. 235 / Wednesday, December 7, 2011 / Rules and Regulations

activities on behalf of a covered entity need to be composed of a single legal accreditation or certification might
(see the definition of a BA at 45 CFR entity, but may contract with other entail. The accreditation or certification
160.103), but qualified entities and entities to achieve the ability to meet the would need to be at a level and scope
providers and suppliers subject to the eligibility criteria, we also clarify that of security that is not less than the level
qualified entity program cannot serve as both the lead entity as well as its and scope of security requirements
BAs because they are not doing their contractors that are anticipated to use described above.
work on behalf of CMS as part of the Medicare claims data or beneficiary Comment: We received no comments
Medicare program. CMS is merely identifiable data are required to sign the on this proposal.
providing data to qualified entities in DUA. As discussed in the proposed Response: Since we received no
accordance with the mandate in the rule, the DUA cited in the proposed rule comments, we will not require qualified
Affordable Care Act, and, as such, its is the current research DUA. We intend entities to have any kind of
disclosure of protected health to use the addendum feature provided accreditation or certification separate
information is permitted by the HIPAA for in paragraph 12 of the document to from CMS’ process in reviewing the
Privacy Rule as ‘‘required by law’’ address the specific needs of the application and requiring a signed DUA.
(45 CFR 164.512(a)). That said, we qualified entity program. With regard to We proposed that all the Medicare
believe our thorough evaluation of the comment suggesting imposition of claims data provided to qualified
applicant qualified entities, the civil and criminal penalties, we point entities would contain a unique
requirement to sign a Data Use out that the DUA currently does, and encrypted beneficiary identification
Agreement (DUA), and subjecting the will continue to have, enforcement number, which would enable the
qualified entities to ongoing monitoring mechanisms including criminal qualified entities to link all Medicare
will be sufficient to ensure that penalties. CMS intends to make use of claims for an individual beneficiary
qualified entities are appropriately these provisions in the event of a breach without knowing the identity (that is,
using the Medicare data, as well as or violation. We do not have the name or Medicare Health Insurance
appropriately disclosing the Medicare statutory authority to impose penalties Claim Number) of the beneficiary. We
data to providers and suppliers who beyond those already listed in the DUA. did not propose to send patient names
request it. Finally, we note that DUAs are specific with the claims data that would be
We proposed to require each to a particular data disclosure from CMS initially disclosed to qualified entities.
approved qualified entity sign a DUA, to a data recipient. Any existing DUAs However, we recognized the need for
which requires a level and scope of a qualified entity may have in place will beneficiary names to facilitate provider
security that is not less than the level only affect the data received under those and supplier appeals.
and scope of security requirements DUAs. The qualified entity program In the proposed rule, we considered
established by the Office of Management DUA will govern qualified entity three potential options for sharing
and Budget (OMB) in OMB Circular No. program Medicare data. beneficiary identifiers with qualified
A–130, Appendix III—Security of Comment: We received some entities, and by extension, providers
Federal Automated Information Systems comments containing suggestions for and suppliers. Under the first option, all
([Link] requirements CMS should impose on qualified entities would be provided
circulars/a130/[Link]) as well as qualified entities with regard to internal with a crosswalk file, with appropriate
Federal Information Processing qualified entity operations. These privacy and security protections, linking
Standard 200 entitled ‘‘Minimum suggestions included requiring that all encrypted beneficiary identifiers to
Security Requirements for Federal qualified entities limit the number of the patients’ names for their Medicare
Information Systems’’ ([Link] staff with access to identifiable data. This would provide the qualified
gov/publications/fips/fips200/FIPS-200- information, and that qualified entities entity with identifiable data, but
[Link]); and Special store Medicare data separately from qualified entities would be permitted to
Publication 800–53 ‘‘Recommended other claims data. give to a provider or supplier only the
Security Controls for Federal Response: The DUA, discussed above, names of the beneficiaries included in
Information Systems’’ ([Link] contains provisions regarding access to that requester’s performance report.
gov/publications/nistpubs/800-53-Rev2/ and storage of CMS data. The DUA Under the second option, CMS would
[Link]). requires the qualified entity to limit only provide beneficiary names to
Comment: Commenters were in access to the identifiable Medicare data qualified entities on a transactional
support of requiring qualified entities to to the minimum number of individuals basis for the purposes of responding to
sign a DUA with CMS. One commenter required to create the performance specific requests for data by providers
suggested we ensure the DUA is reports. The DUA also requires the and suppliers. Each request for
appropriate for this program, since the qualified entity to specify the site where beneficiary names would be addressed
DUA cited in the proposed rule was the the data is to be stored and to grant CMS on a case-by-case basis through the
current DUA used for research access to the site to confirm compliance forwarding of each data request by the
purposes. Another commenter suggested with the DUA. Additionally, as stated in qualified entity to CMS. CMS would
CMS impose civil and criminal the preamble to the proposed rule, we then allow the qualified entity access to
penalties on any qualified entity that believe the entities that will be the beneficiary names for the specific
causes a data privacy breach or successful applicants to this program data request. Under the third option, a
violation. In addition, one commenter are entities that are experienced in provider or supplier who wishes to
requested that we discuss how a handling sensitive information and will receive beneficiary names would
qualified entity’s existing DUAs might have the appropriate internal protocols request the encrypted claims data from
emcdonald on DSK5VPTVN1PROD with RULES2

interact with this program. and procedures in place. the qualified entity as permitted under
Response: We believe the requirement We also sought public comment on the statute. Then, the provider or
for each qualified entity to sign a DUA the appropriateness of accepting some supplier would submit a request to CMS
will ensure a high level of privacy and form of independent accreditation or for the beneficiary names for those
security of the Medicare data given to certification of compliance with data specific claims and CMS would share
qualified entities. Because we have privacy and security requirements from the beneficiary names directly with the
clarified that qualified entities do not qualified entities, and what that provider or supplier. Under the third

VerDate Mar<15>2010 17:17 Dec 06, 2011 Jkt 226001 PO 00000 Frm 00014 Fmt 4701 Sfmt 4700 E:\FR\FM\[Link] 07DER2
 Federal Register / Vol. 76, No. 235 / Wednesday, December 7, 2011 / Rules and Regulations 76555

option, the qualified entity would never identifiable data is not required’’ (76 FR encrypted ID to both the beneficiary
have access to the beneficiary names. 33574), it is clear from the comments name and the beneficiary Medicare
Comment: Comments were mixed noted above that beneficiary identifiable HICN to all qualified entities. This
between favoring the first option and data, with appropriate privacy and constitutes a modified version of option
the second option. Very few security protections, is required if one.
commenters supported the third option. clinical data is to be used or if a We expect that our rigorous eligibility
As discussed above in Section II.B.1., qualified entity needs to link an requirements, the requirement that the
some commenters were interested in individual’s claims records across plans lead entity, as well as any contractors
using measures that incorporate clinical as they move over time from plan to who use the data, sign a DUA, and
data. A number of these commenters plan. comprehensive monitoring process will
noted that the information contained in For example, a qualified entity could ensure that any data shared with
the crosswalk under option one have private plan data for a patient who qualified entities are kept in a manner
(beneficiary names) would be necessary was enrolled in a private health plan in that will not compromise beneficiary
to their being able to link claims data to 2009 and early 2010, but then in May privacy. As noted above, an applicant
clinical data. Several commenters also 2010 enrolled in Medicare. To must have strict data privacy and
noted that they would need an accurately calculate measures, the security protocols in place to be eligible
additional identifier, like the Medicare qualified entity may need to be able to to serve as a qualified entity.
Health Insurance Claim Number (HICN), match the private payer claims data that Furthermore, the DUA contains a
if they were to ensure the accurate covers 2009 and January to April of requirement that the qualified entity
linkage. Among other things, they 2010 for the patient with the Medicare establish the ‘‘appropriate
asserted that the inclusion of multiple claims data that covers May 2010 administrative, technical, and physical
identifiers would ensure that they could forward for the same patient. The safeguards to protect the confidentiality
differentiate amongst individuals with beneficiary name alone would not be of the data and to prevent unauthorized
similar or identical names. sufficient to match patients between use or access to it’’ and does not allow
Additionally, several commenters noted claims data sources because of the high the data to be physically moved,
that, in instances in which an likelihood of duplicative names or transmitted, or disclosed without
individual moved from coverage under naming variations in the data. To written approval from CMS. The DUA
one plan (for example, a private plan) to accurately match claims data from also allows CMS or the Office of the
coverage under another (for example, multiple sources, the patient social Inspector General to access the site
Medicare), they would need patient security number would be ideal.
where the data is stored to confirm
identifiers in order to track the care However, Medicare claims contain the
compliance with required security
provided to a patient over time. These Medicare HICN, which for many
standards. The DUA requires the
commenters also supported the first beneficiaries is the beneficiary’s social
qualified entity to limit access to the
option since it would allow qualified security number plus a letter. In most
data to the minimum amount of data
entities to match an individual’s claims cases the HICN will allow qualified
and minimum number of individuals
from other sources with their Medicare entities to differentiate between
necessary to achieve the purposes of the
claims data. Commenters also supported individuals, and may allow for
qualified entity program. In the event
the first option because it would allow accurately matching claims data
that CMS determines or has a reasonable
qualified entities to quickly respond to between sources in those instances in
requests for the data from providers and which it does include the beneficiary’s belief that unauthorized uses, reuses, or
suppliers, and argued that the first own social security number. We disclosures of the data may have taken
option would be the least burdensome acknowledge that there are cases where place, the DUA allows CMS, among
for qualified entities. the HICN does not include the other things, to require the destruction
One commenter suggested we phase- beneficiary’s social security number, for of all data files and to refuse to release
in release of beneficiary-identifiable example, for beneficiaries who qualify further CMS data to the qualified entity
information: In the first year, qualified for Medicare through their spouse. In for any period of time. As noted above,
entities would receive the full crosswalk these cases, the beneficiary name will be the DUA also contains criminal
so they can easily respond to the the best available identifier to use to penalties, including fines and
anticipated high volume of requests match records from multiple sources, imprisonment, for unauthorized
from providers and suppliers, but in but even if the HICN cannot be used to disclosures of the data. The
later years, after recipients are more match claims data between sources, it comprehensive qualified entity
familiar with the reports, beneficiary- will still be needed to differentiate monitoring program is discussed in
identifiable information would only be individuals with similar names or more detail below in section II.F. and
released on a transactional basis. Still naming variations. includes CMS audits of qualified
other commenters supported the second In light of the overwhelming support entities’ use of the data, site visits, and
option because they felt it offered an for the release of a crosswalk file in the analysis of beneficiary and/or provider
appropriate balance between ensuring comments, the likelihood that entities complaints among other things.
beneficiary privacy and allowing will need the identifiers to combine As a result of the decision to release
qualified entities to respond to specific clinical data or link claims records a crosswalk with appropriate privacy
provider or supplier requests for across plans over time, the need for the and security protections to all qualified
beneficiary names. identifiers to conduct the provider and entities, qualified entities will already
Response: In response to the insights supplier review and appeal process, and be in possession of patients’ names and
emcdonald on DSK5VPTVN1PROD with RULES2

offered by the comments, we plan to the considerable costs that would be HICNs at the time providers and
implement a modified version of the entailed in building a case-by-case suppliers are reviewing draft reports
first option. While we had thought that inquiry capability for qualified entities, and making correction requests. We will
‘‘If one approaches this issue purely we will amend our proposal and adopt ensure that the qualified entity program
from the point of view of the ability of the policy of automatically releasing a DUA (discussed above) provides for
qualified entities to engage in measure crosswalk file with appropriate privacy qualified entities releasing names only
calculation and reporting, beneficiary and security protections linking the upon request by providers and suppliers

VerDate Mar<15>2010 17:17 Dec 06, 2011 Jkt 226001 PO 00000 Frm 00015 Fmt 4701 Sfmt 4700 E:\FR\FM\[Link] 07DER2
 76556 Federal Register / Vol. 76, No. 235 / Wednesday, December 7, 2011 / Rules and Regulations

when that information is relevant to supplier. We solicited comment on any qualified entity and providers and
their review and requests for correction. privacy or security issues related to suppliers in the qualified entity program
We recognize that some may question release of data to providers or suppliers. are not going to be doing anything on
why we are retaining our plan to Comment: We received several behalf of CMS or the Medicare program.
include an encrypted beneficiary comments concerning the privacy and They therefore cannot be BAs of CMS by
identifier in the claims data if every security of the data released to providers virtue of the qualified entity program.
qualified entity will receive the and suppliers. One commenter
crosswalk. We have two reasons to suggested we clarify exactly what data 3. Beneficiary Privacy and Security
separate the claims data from the can be requested from the qualified Following provision of the
beneficiary names and HICNs. First, entity. And, as stated above, comments performance reports on a confidential
shipping the claims data separate from included the suggestion that CMS basis to providers or suppliers, qualified
the crosswalk file adds an additional require non-covered entities (that is, the entities are required to make
level of security while the data is in small fraction of providers who do not performance information public. In
transit. Second, we believe that submit claims electronically, and are accordance with the statute, we
qualified entities may want to limit therefore not subject to HIPAA) to enter proposed to require that qualified
access to the crosswalk file to ensure the into business associate agreements with entities ensure that all publicly
utmost privacy and security of this data CMS, pursuant to HIPAA. available reports do not contain
and having two separate files will make Response: Regarding the request for beneficiary identifiable information.
this much easier. clarification about what data can be Additionally, we proposed to prohibit
It is also worth noting that CMS does released, we stated in the preamble to qualified entities from disclosing
not ship claims data without first the proposed rule (at 76 FR 33577), that information in their publicly available
encrypting the data. Unlike encrypting we believe that for many providers and reports that there is a reasonable basis
an individual data element, this process suppliers, the beneficiary name may be to believe can be used in combination
involves cryptographically scrambling of more practical use in determining the with other publicly available
the data so that it cannot be correctly re- accuracy of the measure results than the information to re-identify individual
assembled (that is, deciphered) unless underlying claims used to calculate the patients.
the receiving party has the correct key. measures. However, the statute does Comment: One commenter suggested
This protects the data while it is in explicitly acknowledge that upon we allow beneficiaries to opt-out of
transit. request qualified entities would need to having their data released under this
We hope that through implementing share with providers or suppliers ‘‘data program.
this modified version of option one with made available under this subsection.’’ Response: We do not have the
appropriate privacy and security We would like to reiterate that we do statutory authority to permit
protections, qualified entities will be not interpret this provision to mean that beneficiaries to opt out of this program.
able to link clinical data to claims data providers or suppliers could receive all However, we also note that the intent of
and match claims data from other Medicare claims data for a given patient this program is to increase transparency
sources to Medicare claims data for the or patients. Rather, we interpret this to and promote innovation in measure
same patient. Additionally, mean that, at the request of providers or development which we believe will
implementing a modified version of suppliers, qualified entities will provide contribute significantly to improving
option one allows qualified entities to only claims and/or beneficiary names beneficiary care in the long run. As
quickly respond to requests from relevant to the particular measure or mentioned above, we also believe the
providers or suppliers for beneficiary measure results that the provider or final rule contains appropriate
identifiers during the report review and supplier is appealing. beneficiary privacy protections and
correction request process. Since we made a technical change in penalties for any misuse of the data by
the regulation text and removed the qualified entities.
2. Privacy and Security Requirements of
reference to section 1874(e) from the
Data Released to Providers and E. Confidential Opportunities To
definition of a qualified entity (as noted
Suppliers Review, Appeal, and Correct Errors
above in Section II.A.1.), we have added
Section 1874(e)(4)(B)(v) of the Act the requirement that qualified entities One important aspect of this program
requires qualified entities to make the release Medicare claims to providers is ensuring that providers and suppliers
Medicare claims data they receive and suppliers to the regulation text. We are afforded an opportunity to correct
available to providers and suppliers have added a requirement in errors in the reporting of their
upon their request. We do not interpret § 401.717(c) that qualified entities, at performance metrics. To meet the
this requirement to mean that providers the request of a provider or supplier and requirements in the statute related to
or suppliers could receive all Medicare with appropriate privacy and security appeal and error correction, we
claims data for a given patient or protections, release the Medicare claims proposed to require applicants to
patients. Rather, we proposed to require and/or beneficiary names to the include a plan for their report review,
qualified entities to provide, with provider or supplier, but we require appeals, and error correction process in
appropriate privacy and security qualified entities to only release those their application. This plan would
protections, only the claims relevant to claims and/or beneficiary names contain several elements, including the
the particular measure or measure relevant to the measure or measure means for sharing results confidentially
results being appealed. Therefore, for results being appealed. and the means by which a provider or
example, a provider or supplier As stated above, we acknowledge that supplier can request and receive
emcdonald on DSK5VPTVN1PROD with RULES2

requesting claims data in relation to a the providers and suppliers who request Medicare claims data. We proposed that
diabetes quality measure would only data may or may not be covered entities qualified entities would need to
receive the claims related to the under HIPAA. Also, as noted above, a confidentially share measure results
calculation of that quality measure. We BA is limited to a person or an entity with providers and suppliers at least 30
realize this may result in providers or using or disclosing individually days prior to making the reports public.
suppliers receiving data related to identifiable health information on We also proposed that qualified entities
claims submitted by another provider or behalf of a HIPAA covered entity. The must inform providers and suppliers

VerDate Mar<15>2010 17:17 Dec 06, 2011 Jkt 226001 PO 00000 Frm 00016 Fmt 4701 Sfmt 4700 E:\FR\FM\[Link] 07DER2
 Federal Register / Vol. 76, No. 235 / Wednesday, December 7, 2011 / Rules and Regulations 76557

that the report would be made public on beneficiary names only at the request of made public; however, we believe that
a certain date (at least 30 days after a provider or supplier and only for the it is up to the qualified entity and
confidentially sharing the measure measure or measure results being provider or supplier to manage the
results), regardless of the status of error appealed strikes the appropriate balance timing of this process to ensure that
correction. between protecting beneficiary privacy they have adequate time to request the
Comment: We received several and allowing providers and suppliers data and, if necessary, request error
comments on the overall review, the opportunity to provide input on correction(s).
appeals, and error correction process. their reports. Comment: We received several
Some commenters asked CMS to The statute requires that qualified comments on our proposal that
standardize the process across qualified entities make reports available to qualified entities publish reports on a
entities. On the other hand, one providers and suppliers prior to the certain date, regardless of the status of
commenter argued that if CMS both public release of reports. Since each requests for appeals or error correction.
approves and audits the claims and the provider or supplier will confidentially Several commenters requested that CMS
qualified entity process for creating the receive any report where they are not allow qualified entities to publish
reports, review by providers and identified, we see no need for qualified measure results until the request for
suppliers is unnecessary. Another entities to announce publically the error correction is resolved. Other
commenter asked CMS to require availability of reports. Additionally, we commenters recommended that we
qualified entities to automatically acknowledge the importance of ensuring create a two-step track where if a
provide the beneficiary names to the data is securely transmitted to the request cannot be resolved between the
providers and suppliers. Several correct provider or supplier. However, qualified entity and a provider or
commenters asked CMS to require we believe that it is the responsibility of supplier, the request is elevated to CMS
qualified entities to announce publically the qualified entity to ensure that the for a final decision. Furthermore, some
on a Web site supported by HHS or in data is delivered using a secure method commenters wanted CMS to require
notifications to major organizations that to the appropriate provider or supplier qualified entities to publish provider or
represent providers and suppliers that and require applicants to describe their supplier comments in the report if a
have been evaluated by the qualified means of confidentially sharing reports request is not resolved at the time of
entity, the availability of reports for with providers and suppliers as part of report publication. One commenter
confidential review. Finally, several their application. requested that CMS allow providers or
commenters suggested allowing Comment: Many commenters argued suppliers to publicly defend themselves
qualified entities to require that a that the proposed time period between if reports are published prior to
provider or supplier document and providers and suppliers confidentially resolving error correction requests. We
authenticate their identity and, if receiving reports and the qualified also received a comment suggesting
requesting data, their legal right to see entity publically reporting results is too CMS allow providers or suppliers to
the data, as well as provide a secure short. Commenters suggested a time appeal after reports are made public.
communication process for transmission period of 60 or 90 days. Finally, one commenter asked CMS to
of requested information. Response: We recognize, in light of ensure that qualified entities have the
Response: We believe an important the comments, that our proposal may appropriate amount of staff to respond
aspect of the qualified entity program is not have allowed providers and to appeals.
innovation, not only in the development suppliers an appropriate amount of time Response: We acknowledge the
of measures, but also in the process for to review their confidential reports. interest of providers and suppliers in
sharing measure results with However, we also recognize the ensuring that any measure results
physicians, as well as the process for importance of ensuring that report reported publicly are correct. However,
responding to requests for data and for results are released to the public in a as we mentioned in the proposed rule,
error correction. To reiterate, this is not timely manner. Therefore, qualified we included this requirement to prevent
a Medicare quality measurement entities must share measures, providers or suppliers from making
program—we are merely a data source measurement methodology, and spurious requests for error correction to
for those who meet the requirements measure results with providers and prevent the publication of measure
laid out in this subpart. Qualified suppliers at least 60 calendar days prior results. We will maintain our
entities design their programs within to making the measure results public. requirement that qualified entities
the statutory and regulatory limits, Beginning on the date on which the publicly report measure results on the
including crafting their own qualified entity sends the confidential date specified to the provider or
confidential review, appeals, and error reports to a provider or supplier, that supplier when the report is sent for
correction processes. This will result in provider and supplier will have a review (at least 60 days after the date on
innovations that will improve the way minimum of 60 calendar days to review which the confidential reports are sent
providers and suppliers receive reports the reports, make a request for the data, to a provider or supplier), regardless of
and interact with the qualified entity. review the data, and, if necessary, make the status of a request for error
The statute is clear in the requirement a request for error correction. Qualified correction. We hope that by extending
that qualified entities develop a entities also must inform providers and the amount of time between
confidential review, appeals, and error suppliers of the date the reports would confidentially sharing reports with
correction process, so we do not agree be made public at least 60 calendar days providers and suppliers and publically
that this is an unnecessary part of the before making the reports public. reporting results to at least 60 calendar
qualified entity program. Furthermore, Additionally, the qualified entity must days, we are allowing both providers
emcdonald on DSK5VPTVN1PROD with RULES2

while we understand the interest in publically release reports on the and suppliers ample opportunity to
obtaining beneficiary names specified date regardless of the status of resolve the appeals process. If an appeal
automatically, protecting the privacy any requests for error correction. We request is still outstanding at the time of
and security of beneficiary identifiable recognize that this process allows public reporting, we will maintain the
information is required by the statute, as providers and suppliers to make a requirement that qualified entities post
well as being of the utmost importance request for the data or a request for error publicly the name and category of the
to CMS. We feel that releasing correction up to the point the reports are appeal request for providers or suppliers

VerDate Mar<15>2010 17:17 Dec 06, 2011 Jkt 226001 PO 00000 Frm 00017 Fmt 4701 Sfmt 4700 E:\FR\FM\[Link] 07DER2
 76558 Federal Register / Vol. 76, No. 235 / Wednesday, December 7, 2011 / Rules and Regulations

with outstanding requests for error proposed a monitoring program that entity is composed of a lead entity and
correction, if feasible, but do not believe would assess compliance with the contractors, contractors will also be
that qualified entities should be requirements of the program and assess subject to CMS monitoring. We believe
required to publicly post comments sanctions or termination as deemed that annual reports and site visits are
from providers or suppliers. appropriate by CMS. We proposed that essential to allow CMS to best monitor
Additionally, since this program does CMS, or one of its designated the program and to both maximize the
not involve CMS contracting with contractors, would periodically audit appropriate use of Medicare data for the
qualified entities to carry out a quality (including site visits) qualified entities production of performance reports and
measurement program on behalf of for their use of the Medicare data to minimize the risk of inappropriate
CMS, we do not believe it is appropriate ensure that the data is only being used disclosure of beneficiary information.
for CMS to become involved in the for its intended purpose. We also We proposed that a qualified entity
appeals and error correction process or proposed to monitor the amount of must immediately inform CMS if its
to offer a public forum for providers or claims data from other sources the amount of claims data from other
suppliers to defend themselves. We qualified entity is using in the sources decreases. We also proposed to
recognize the concern about ensuring production of performance reports using require that the qualified entity provide
that a qualified entity has the documentation produced by the documentation that the remaining non-
appropriate staff to respond to requests qualified entity or, at the discretion of Medicare claims data is still sufficient to
for error correction. However, we are CMS, site visits. Additionally, we address methodological concerns
certain that the rigorous application proposed to use analysis of beneficiary regarding sample size and reliability
process will guarantee that only and/or provider complaints to monitor expressed by stakeholders regarding the
qualified organizations receive Medicare and assess the performance of qualified calculation of performance measures
claims data. Additionally, we will be entities. We also proposed to require from a single source. As reflected at
monitoring qualified entities to qualified entities to submit an annual § 401.706(c) of the proposed rule, the
determine if they are promptly report covering program adherence (for qualified entity would no longer be able
responding to requests for data and example, number of claims, market to issue a report, use a measure, or share
requests for error correction. share, number of measures) and a report after the amount of claims data
In the proposed rule, we engagement of providers and suppliers from other sources decreases until CMS
acknowledged that CMS does not have (for example, requests for data, number made an assessment as to the
the statutory authority to require of corrections, time to respond to sufficiency of the remaining data. If
qualified entities to share their claims requests for appeal or error correction). CMS determined that the qualified
data from other sources. We encouraged Finally, we proposed requiring qualified entity’s remaining claims data was not
qualified entities to share this data with entities to submit to CMS information sufficient, we proposed that the
providers or suppliers upon request. regarding any inappropriate disclosures qualified entity would have 60 days to
Comment: We received multiple or uses of beneficiary identifiable data acquire new data and submit new
comments asking CMS to require pursuant to the requirements in the documentation to CMS. The qualified
qualified entities to release their non- DUA. entity would not be able to use
Medicare claims data to providers or Comment: We received many Medicare data to issue reports, use
suppliers upon request. Some comments supporting our monitoring measures, share measures, or share a
commenters requested that CMS only program. Some commenters specifically report during this time. If after re-
approve entities who agreed to release supported the requirement that submission of documentation, CMS
their other claims data. qualified entities submit a report determined the qualified entity still did
Response: We do not have the covering the engagement of providers not possess adequate data, we proposed
statutory authority to require qualified and suppliers. One commenter asked to terminate the relationship with the
entities to release their non-Medicare CMS to ensure that there is appropriate qualified entity. If after resubmission of
data. We hope that qualified entities funding for CMS to conduct the documentation, CMS determined that
will choose to do so whenever it is necessary qualified entity monitoring the qualified entity did possess
legally permitted, but are aware that activities. sufficient data, we proposed the
their ability to release other claims data Response: We would like to reiterate qualified entity could resume all
is partially dependent on the terms of our commitment to ensuring the measurement and reporting activities.
the arrangement the qualified entity has successful implementation of this Comment: Commenters requested two
with the entity from whom they program and that all qualified entities changes to our proposed process for
received the data. adhere to the highest standards, which addressing a decrease in the amount of
Comment: Commenters suggested we includes ensuring that we have the other claims data. First, several
implement 2012 as a ‘‘test year’’ for the necessary funding to support a commenters suggested that qualified
program and allow qualified entities to monitoring program. entities only be required to stop
only produce confidential performance Comment: Some commenters made measurement and reporting if the
reports without any public reporting. suggestions about specific aspects of the decrease in other claims data is
Response: We do not have the monitoring plan. One commenter significant. Second, commenters
statutory authority to implement a ‘‘test suggested that qualified entities only requested more time for qualified
year’’ for this program. The statutory submit reports on program adherence entities to acquire new data.
effective date of this provision is and engagement of providers and Response: While we recognize the
suppliers once every two years. interest in continuing measurement
emcdonald on DSK5VPTVN1PROD with RULES2

January 1, 2012, and all requirements

under the law are applicable on that Additionally, several commenters efforts during this review process, we
date. requested CMS not include site visits as believe it is important for CMS to make
a part of monitoring because it is too the determination as to whether the
F. Monitoring, Oversight, Sanctioning, burdensome. remaining claims data is adequate to
and Termination Response: We plan to maintain our ensure that the methodological concerns
To ensure that qualified entities proposed monitoring process and note regarding sample size and reliability
adhere to the highest standards, we that, in the cases where a qualified expressed by stakeholders regarding

VerDate Mar<15>2010 17:17 Dec 06, 2011 Jkt 226001 PO 00000 Frm 00018 Fmt 4701 Sfmt 4700 E:\FR\FM\[Link] 07DER2
 Federal Register / Vol. 76, No. 235 / Wednesday, December 7, 2011 / Rules and Regulations 76559

calculation of performance measures there are degrees of seriousness in G. Qualified Entity Application Content
from a single payer source. To ensure inaccurate reporting, and some We proposed to develop an
that the decrease does not materially situations may not warrant termination, application process for organizations
affect the validity of measure results, we particularly if the inaccuracy was interested in becoming qualified entities
will maintain our proposal to require unintentional, CMS was promptly in which they would provide certain
qualified entities to stop all activities identified, and the inaccuracy was specified information. We proposed
while CMS reviews the documentation promptly resolved. We will therefore applications and related materials
related to the decrease in other claims maintain our proposal to base our would be collected and reviewed once
data; after the amount of claims data actions on the seriousness of the a year, at the close of the first quarter
from other sources decreases, the deficiency. of the calendar year. We proposed
qualified entity would no longer be able
Comment: Several commenters approval periods of three years,
to create a report, use a measure, or
requested clarification on how long followed by an opportunity to reapply.
share a report (either confidentially or
qualified entities would be able to keep Comment: We received comments
publically) using Medicare data until
the Medicare data that they receive containing suggestions for how CMS
CMS determines either that the
under this program. One commenter could improve the application content
remaining claims data is sufficient, or
suggested placing an outer limit on and process. Specifically, one
that the qualified entity has collected
retention of files. commenter suggested using a standard
adequate additional data to address any
electronic application. Additionally, a
deficiencies. That said, we recognize the Response: After carefully considering commenter suggested that CMS accept
request to extend the amount of time a the beneficiary privacy and security applications on a rolling basis. Another
qualified entity has to acquire new data, implications of our policy, we do not commenter preferred that CMS not
so we will extend this timeframe to 120 believe that qualified entities must
days. require re-application after three years.
destroy or return Medicare data Response: CMS appreciates and
We also proposed that if a qualified
(including crosswalks) provided under acknowledges the benefits of accepting
entity is not adhering to the
requirements of the program, CMS may the qualified entity program unless they qualified entity applications on a rolling
take several enforcement actions, such voluntarily leave or are involuntarily basis instead of once annually. This
as providing a warning notice, terminated from the program. Qualified would allow organizations to apply to
requesting a corrective action plan, entities will need to retain the Medicare be a qualified entity as soon as they
placing an entity on a special data, with appropriate privacy and believe they meet all the eligibility
monitoring plan, or terminating the security protections, in order to trend requirements, instead of requiring the
qualified entity. These enforcement measure results over time or to calculate organization to wait a year until the next
actions are in addition to the actions measures that require a number of years application cycle. We are therefore
CMS may take if a qualified entity of data for measure calculation. We changing to a rolling application
violates the DUA, as discussed in more understand that this will mean that process. We will also use an electronic
detail above in section II.D.1. The qualified entities will also retain application.
choice of enforcement action would beneficiary identifiable data (including While we understand the burdens that
depend on the seriousness of the that found in the crosswalks), but we re-application will impose, we also need
deficiency. Any time a qualified entity believe that this information will also be to ensure that Medicare data are being
is voluntarily or involuntarily necessary to calculate measures that used appropriately and handled
terminated, we proposed requiring the require a number of years of claims data. securely. While we believe the
destruction or return of Medicare data We feel it is important to note that a monitoring program described above
within 30 days. beneficiary’s encrypted identifier will will help ensure qualified entities
Comment: We received some not change from year to year, so unless continue to meet the requirements of the
comments stating that the proposed a beneficiary dies or moves out of the program, the application process covers
penalties are not strict enough. geographic region, the qualified entity significantly more aspects of an
Additionally, one commenter requested organization’s continuing ability to
will continue to need the crosswalk
that CMS provide for termination for serve as a qualified entity. Therefore,
linking the encrypted ID to the
inaccurate reporting or for failing to CMS believes that requiring re-
beneficiary HICN and name to carry out
make timely corrections upon providers’ application every three years balances
the activities outlined above in our
or suppliers’ request. the burden on qualified entities with the
Response: We are limited by the crosswalk discussion. We have carefully
need to ensure Medicare data is being
statute in the penalties we can impose considered the beneficiary privacy and handled appropriately.
on qualified entities who do not comply security implications of our policy, and
note that the DUA remains in effect so H. Other Comments
with the requirements of the program.
We note, however, that CMS does have long as the qualified entity participates We received several additional
additional enforcement capabilities for in the program. Furthermore, the suggestions for improvements to the
violations of the DUA, including monitoring requirements described program regarding topics that were not
criminal penalties. As CMS will require herein, as well as the requirement that specifically discussed in the preamble
the lead entity, as well as any qualified entities reapply every three to the proposed rule.
contractors who have access to the years as described below in section II.G., Comment: A few commenters advised
Medicare claims data or beneficiary should assist in ensuring that this data that CMS require knowledge sharing
emcdonald on DSK5VPTVN1PROD with RULES2

identifiable data, to sign the DUA before remains secure and private. We would among qualified entities, rather than
CMS releases any data, these penalties like to reiterate, however, that once an merely suggesting it.
will apply to all organizations with entity voluntarily leaves or is Response: CMS agrees with
access to the Medicare data. involuntarily terminated from the commenters that performance
While CMS reserves the right to program it must destroy or return all improvement will occur most rapidly in
terminate a qualified entity for CMS data provided under this an open collaborative environment
inaccurate reporting, we believe that subsection within 30 days. where ideas and knowledge are shared

VerDate Mar<15>2010 17:17 Dec 06, 2011 Jkt 226001 PO 00000 Frm 00019 Fmt 4701 Sfmt 4700 E:\FR\FM\[Link] 07DER2
 76560 Federal Register / Vol. 76, No. 235 / Wednesday, December 7, 2011 / Rules and Regulations

freely and openly. CMS will strongly measurement information will be requested that we ensure the program
encourage and facilitate, where possible, published. can accommodate the transition to
collaborative knowledge sharing, but Response: The statute requires that ICD–10.
will not require it as a condition of qualified entities allow confidential Response: We clarify that this
program participation. review of the reports, that they be program will not have any effect on
Comment: Several commenters provided to the public, and that the other CMS programs in which Medicare
expressed concern about CMS reports contain understandable claims data are released. CMS is
conducting performance analysis of descriptions of the methodologies used. working to ensure that the transition to
providers and suppliers. Commenters Qualified entities must receive approval ICD–10 happens smoothly.
also expressed concern about of report formats before they can be Comment: One commenter requested
performance measurement generally, published, but each qualified entity has that CMS only allow measurement and
and had specific concerns about the discretion to design reports and rating of providers and suppliers in
performance measurement based solely publish using the approved formats. situations where CMS pays for the item
on claims data. Comment: One commenter suggested or services.
Response: This program is not a CMS that CMS make available the full data Response: Medicare only pays claims
measurement program and, therefore, set at no charge to recognized provider for covered services and supplies; if a
CMS will not be conducting organizations such as the American service or supply is not covered, a claim
performance analysis of providers and Medical Association and allow will not appear in the Medicare data.
suppliers in this program. Rather providers and suppliers to analyze their While a qualified entity could decide to
qualified entities will combine Medicare data there. produce a measurement report based
claims data supplied by CMS with other Response: The statute does not permit
solely on its other claims data, such
claims data to calculate performance CMS to release the data to any entity
reporting would be outside of the
measures for providers and suppliers. other than those approved as qualified
entities. However, as stated in the qualified entity program and the reports
We recognize commenters’ concerns
preamble to the proposed rule, we are would be outside of the reach of these
about the limitations of performance
not placing any restrictions on the types regulations.
measurement based on claims data
alone. Therefore, as discussed above in of organizations that can apply to be a III. Provisions of the Final Regulations
section II.B.1, we will allow qualified qualified entity. If a recognized provider
For the most part, this final rule
entities to use measures that incorporate organization meets the eligibility
criteria, it can become a qualified entity incorporates the provisions of the
clinical data, as long as the measure can
and receive Medicare data. proposed rule. Those provisions of this
be calculated in part from Medicare and
Additionally, the statute does not final rule that differ from the proposed
other claims data.
Comment: Commenters suggested permit CMS to release data at no charge. rule are as follows:
CMS should undertake a public Section 1874(e)(4)(A) states that the data • We have made technical changes to
education and outreach program to ‘‘shall be made available * * * at a fee the definition of a qualified entity,
inform consumers about the qualified equal to the cost of making such data provider, and supplier to reflect
entity program and explain the available.’’ That said, as discussed in regulatory interpretation of the statutory
limitations of provider and supplier section II.C.3. above, we have revised provisions cited in the proposed rule.
performance measurement. our method for pricing this data and we We have also added a definition of
Response: We agree that CMS should believe the data will be significantly claims data from other sources at
inform consumers about the qualified more affordable than originally § 401.703(h) and a definition of clinical
entity program. We also believe it is proposed. data at § 401.703(i).
essential for CMS to be transparent to Comment: One commenter requested • We clarify that qualified entities do
beneficiaries and the general public that CMS clarify that the data released not need to be a single organization.
about our plans for sharing identifiable to qualified entities will not be subject Applicants may contract with others to
information, with appropriate privacy to discovery or admissible as evidence achieve the ability to meet the eligibility
and security protections, with qualified in judicial or administrative criteria. Specifically, at § 401.705(b) we
entities. CMS will publish educational proceedings. allow entities to demonstrate expertise
materials on the CMS Web site Response: The statute, at and experience through activities it has
regarding the qualified entity program, 1874(e)(4)(D), explicitly states, ‘‘[d]ata conducted directly or through (a)
including a description of the released to a qualified entity under this contract(s) with other public or private
beneficiary information that is being subsection shall not be subject to entities.
shared with qualified entities and an discovery or admission as evidence in • We changed our eligibility
explanation of the privacy and security judicial or administrative proceedings requirements at § 401.705(a)(1) to only
requirements, as well as the qualified without consent of the applicable require that entities demonstrate
entity monitoring program and provider of services or supplier.’’ We expertise in quality measurement and in
termination policies. acknowledge that we did not address the other three areas of measurement
We also hope that qualified entities this specific statement in the preamble (efficiency, effectiveness, and resource
will engage in public education and to the proposed rule, but we believe this use) to the extent that they propose to
outreach in the communities where they statement is self-implementing in that it use such measures.
serve. However, we are not requiring requires no further explanation, and the • At § 401.705(a)(1)(ii) we clarify that
qualified entities to do public outreach data will not be subject to discovery or we only expect applicants to submit a
emcdonald on DSK5VPTVN1PROD with RULES2

beyond making the performance reports, admission as evidence absent the plan for a business model that is
with an understandable description of described consent(s). projected to cover the costs of
the measures, available to the public Comment: One commenter asked performing the required functions. We
after confidential review by providers CMS to clarify that these regulations realize that qualified entities may need
and suppliers. have no effect on any other programs in to adapt this plan once they are
Comment: One commenter requested which Medicare claims data are approved and do not intend to limit an
that we clarify how performance released. A second commenter entity’s ability to adapt or change its

VerDate Mar<15>2010 17:17 Dec 06, 2011 Jkt 226001 PO 00000 Frm 00020 Fmt 4701 Sfmt 4700 E:\FR\FM\[Link] 07DER2
 Federal Register / Vol. 76, No. 235 / Wednesday, December 7, 2011 / Rules and Regulations 76561

business plan once approved as a • We have added measures endorsed Medicare claims data for the purpose of
qualified entity. by a CMS-approved consensus-based calculating national benchmarks.
• We added language at entity to the list of standard measures. • Using appropriate privacy and
§ 401.705(a)(1)(vii) that would require CMS will approve organizations as security protections, we will provide
qualified entities to also disclose any consensus-based entities based on qualified entities (that sign the DUA and
violations of applicable federal and review of documentation of the meet all the privacy and security
State privacy and security laws and consensus-based entity’s measure requirements) with a crosswalk file
regulations for the preceding 10-year approval process. linking encrypted beneficiary ID to the
period, in addition to requiring • We have added a second process by beneficiary name and beneficiary Health
qualified entities to disclose any which qualified entities may seek Insurance Claim Number.
inappropriate disclosures of beneficiary approval to use alternative measures. • At § 401.717(a), we extended the
identifiable information for the Organizations and individuals will still time period between a qualified entity
preceding 10-year period. We also be able to submit alternative measures sending a confidential report to a
clarified that for those entities that have for approval through the notice and provider or supplier and public
not been in existence for 10 years, we comment rulemaking process. However, reporting of measure results to at least
will require a breach history for the at § 401.715(b)(1)(ii), we also allow an 60 calendar days.
length of time the organization has been entity to submit measures for approval • We will allow qualified entities 120
in existence. by the Secretary by submitting: (1) A days to acquire new data if the amount
• We have revised the selection description of the process by which the of other claims data they have decreases
criteria to allow applicants to apply and qualified entity notified stakeholders and CMS determines the remaining
receive a conditional acceptance as a (defined as a valid cross representation amount of other claims data is not
qualified entity if they do not have of providers, suppliers, employers, sufficient.
adequate claims data from other sources payers, and consumers) in the • We changed our application process
at the time of their application, but meet geographic region the qualified entity and will accept applications on a rolling
all the other selection requirements. serves of its intent to seek approval of basis as discussed at § 401.709(a).
• Since standard measure an alternative measures; (2) a list of
specifications are available to the public IV. Collection of Information
stakeholders from whom feedback was
at this time, we removed the solicited, including the stakeholder Requirements
requirement that qualified entities names and each stakeholder’s role in the Under the Paperwork Reduction Act
submit measure specifications for community; (3) a description of the of 1995, we are required to provide
standard measures the qualified entity discussion about the proposed 30-day notice in the Federal Register
plans to calculate. alternative measure, including a and solicit public comment before a
• We clarified that these regulations summary of all pertinent arguments for collection of information requirement is
do not place any added limitations on and against the measure; and (4) unless submitted to the Office of Management
the qualified entity’s ability to copyright CMS has already approved the same and Budget (OMB) for review and
the content of the publicly released measure for use by another qualified approval. In order to fairly evaluate
reports. We noted, however that the entity, an explanation backed by whether an information collection
qualified entity must provide scientific evidence that demonstrates should be approved by OMB, section
confidential reports to the subject why the measure meets the 3506(c)(2)(A) of the Paperwork
providers and suppliers free of charge requirements for alternative measures at Reduction Act of 1995 requires that we
and must provide the final reports to the Section 1874(e)(4)(B)(i)(II) of the Act. If solicit comment on the following issues:
public free of change in a manner a qualified entity is seeking to use an • The need for the information
consistent with the requirements in the alternative measure that CMS has collection and its usefulness in carrying
qualified entity program statute. already approved for use by another out the proper functions of our agency.
• At § 401.711(a) we allow qualified qualified entity, the qualified entity • The accuracy of our estimate of the
entities to change their list of proposed submitting the measure for approval information collection burden.
measures, proposed prototype report, must submit any additional or new • The quality, utility, and clarity of
and plans for sharing reports with the scientific evidence, if it is available. If the information to be collected.
public with 30 days notice to CMS, a CMS decision on approval or • Recommendations to minimize the
instead of 90 days notice to CMS. We disapproval of measures submitted via information collection burden on the
provide for a possible 30-day extension the process at 401.715(b)(1)(ii) is not affected public, including automated
of the review period where necessary. If forthcoming 60 days after the collection techniques.
a CMS decision on approval or submission of the measure, the measure We are soliciting public comment on
disapproval for a change or modification will be deemed approved. However, each of these issues for the following
is not forthcoming within 30 days or CMS retains the right, even after 60 sections of this document that contain
CMS does not request an additional 30 days, to direct the qualified entity to information collection requirements
days for review, the change or stop using the measure if we (ICRs).
modification shall be deemed to be subsequently find the measure does not If finalized, these regulations would
approved. meet the requirements at Section require an organization seeking to
• We will allow qualified entities to 1874(e)(4)(B)(i)(II) of the Act. receive data as a qualified entity to
use standard and alternative measures • We have identified efficiencies that submit an application. Specifically, an
calculated in full or in part from will reduce the cost of Medicare claims applicant must submit the information
emcdonald on DSK5VPTVN1PROD with RULES2

Medicare Parts A and B claims, and Part data under the qualified entity program, listed in §§ 401.705–401.709. The
D prescription drug event data and and we have altered the dates of data burden associated with this requirement
claims from other sources. This means that will be made available through this is the time and effort necessary to
that qualified entities will be allowed to program, thereby increasing the gather, process, and submit the required
calculate measures that include clinical timeliness of that data. information to CMS. We estimate that
data. As noted above, we have added a • We will allow qualified entities to 35 organizations would submit
definition of clinical data at § 401.703(i). purchase a 5 percent national sample of applications to receive data as qualified

VerDate Mar<15>2010 17:17 Dec 06, 2011 Jkt 226001 PO 00000 Frm 00021 Fmt 4701 Sfmt 4700 E:\FR\FM\[Link] 07DER2
 76562 Federal Register / Vol. 76, No. 235 / Wednesday, December 7, 2011 / Rules and Regulations

entities. We further estimate that it data for purposes other than those associated with this requirement is 120
would take each applicant 500 hours to referenced above. The burden associated hours at an estimated cost of $136,396.
gather, process and submit the required with executing this DUA is currently Section 410.719(b) requires qualified
information. The total estimated burden approved under OMB control number entities to submit annual reports to CMS
associated with this requirement is 500 0938–0734.
Section 401.709(f) would require as part of CMS’ ongoing monitoring of
hours per applicant at an estimated cost
qualified entities in good standing to re- qualified entity activities. We estimate
of $795,641.
Section 401.713(a) states that as part apply for qualified entity status 6 that the 25 entities in the program will
of the application review and approval months before the end of their three- be required to comply with this
process, a qualified entity would be year approval period. We estimate that requirement. We estimate that it will
required to execute a Data Use 25 entities would be required to comply take 150 hours to complete an annual
Agreement (DUA) with CMS, that with this requirement. We estimate that monitoring report. The total estimated
among other things, reaffirms the it would take 120 hours to reapply to burden associated with this requirement
statutory bar on the use of Medicare CMS. The total estimated burden is 150 hours at $170,475.
TABLE 1—ESTIMATED ANNUAL RECORDKEEPING AND REPORTING BURDEN
Total
Hourly labor Total labor capital/
Burden per Total annual
OMB control cost of cost of mainte- Total cost
Regulation section(s) Respondents Responses response burden
No. reporting reporting nance ($)
(hours) (hours) ($) ($) * costs
($)

§ 401.705(a) ............................ 0938–New .. 35 35 500 17,500 ** 795,641 0 795,641

§ 401.709(f) ............................. 0938–New .. 25 25 120 3,000 ** 136,396 0 136,396
§ 401.719(b) ............................ 0938–New .. 25 25 150 3,750 ** 170,475 0 170,475

Total ................................. .................... 35 35 .................... 24,250 .................... .................... .................... 1,102,512

* Total labor cost assuming 92% of total hours are professional and technical and 8% are legal.
** Wage rates vary by level of staff involved in complying with the information collection request (ICR).

To obtain copies of the supporting recognize commenters’ concerns and, as correction requests is too low. Many
statement and any related forms for the discussed above, have removed the commenters also argued that the hourly
proposed paperwork collections program management costs from the fee wage rate for physicians’ offices is too
referenced above, access CMS’ Web site we will charge for the data. As further low. Finally, a number of comments
at [Link] addressed above, we have also suggested that providers and suppliers
ReductionActof1995/PRAL/[Link]# identified several efficiencies in the might hire contractors to help with
TopOfPage or email your request, creation of the data files which will reviewing draft reports and requesting
including your address, phone number, further lower the cost of the data. corrections.
OMB number, and CMS document However, we would like to reiterate that Response: While we understand that
identifier, to Paperwork@[Link], these estimates are based on a qualified some providers and suppliers may
or call the Reports Clearance Office at entity program with 25 approved spend many hours reviewing reports
410–786–1326. qualified entities. The cost of the data and submitting correction requests, we
If you comment on these information will increase if fewer organizations are believe 5 hours reviewing reports is
collection and recordkeeping approved as qualified entities and appropriate as an average. For example,
requirements, please submit your decrease if more organizations are some providers and suppliers will
comments to the Office of Information approved as qualified entities because spend less than an hour reviewing their
and Regulatory Affairs, Office of the fixed costs of providing the data reports, but others may spend 10 hours.
Management and Budget, would be spread across the total number The same situation applies for error
Attention: CMS Desk Officer, CMS– of qualified entities. correction requests. Some providers and
5059–F. Comment: We received a handful of suppliers may only have concerns about
Fax: (202) 395–6974; or comments stating that the application one measure, and after seeing the data
Email: process for qualified entities is too may realize that their concerns were
OIRA_submission@[Link]. burdensome. unfounded. However, others may
V. Regulatory Impact Analysis Response: As discussed above, we engage in a longer discourse with the
believe ensuring that organizations qualified entity. On average, we believe
A. Response to Comments approved as qualified entities are that providers and suppliers will spend
We received several comments on the experienced in performance approximately 10 hours preparing and
anticipated effects of the program. measurement and reporting and have submitting error correction requests. We
Comment: Several commenters argued the necessary plans to serve as a do recognize that some providers and
that the cost of the data is too high. As qualified entity is essential for the suppliers may choose to hire contractors
stated above, these commenters often success of the qualified entity program. to assist in preparing and submitting a
recommended CMS remove the data Thus, we do not believe the application correction request and have added this
emcdonald on DSK5VPTVN1PROD with RULES2

application costs or provide a sliding is too burdensome. to the impact on providers and
scale fee for the data, charging non- Comment: We received several suppliers discussed below.
profits and government organizations a comments on the impact on providers Additionally, while we understand
lower fee. and suppliers. A number of commenters physicians’ hourly wage exceeds $30.90,
Response: While we do not feel we stated that the number of hours we believe physicians are not the only
were being too broad in our estimated for a provider or supplier to ones in their offices who will be
interpretation of the statute, we review performance reports or submit reviewing the performance reports and

VerDate Mar<15>2010 17:17 Dec 06, 2011 Jkt 226001 PO 00000 Frm 00022 Fmt 4701 Sfmt 4700 E:\FR\FM\[Link] 07DER2
 Federal Register / Vol. 76, No. 235 / Wednesday, December 7, 2011 / Rules and Regulations 76563

submitting correction requests. Some of and physicians. Many hospitals and anticipated costs and benefits before
this work may be done by other most other health care providers and issuing any rule whose mandates
physician office staff such as suppliers are small entities, either by require spending in any 1 year of $100
administrative staff, nurses, physician being nonprofit organizations or by million in 1995 dollars, updated
assistants, and case workers. Therefore, meeting the Small Business annually for inflation. In 2011, that
we believe our average hourly wage rate Administration definition of a small threshold is approximately $136
is appropriate to calculate the impact of business (having revenues of less than million. This rule would not mandate
this program on providers and $34.5 million in any 1 year) (for details, any requirements for State, local, or
suppliers. Changes described in our see the Small Business Administration’s tribal governments in the aggregate, or
response are reflected in the remainder Web site at [Link] by the private sector, of $136 million.
of the Regulatory Impact Analysis. public/documents/sba_homepage/ Specifically, as explained below we
serv_sstd_tablepdf.pdf (refer to the anticipate the total impact of this final
B. Overall Impact
620000 series). For purposes of the RFA, rule on all parties to be approximately
We have examined the impacts of this physicians are considered small $86 million.
rule as required by Executive Order businesses if they generate revenues of Executive Order 13132 establishes
12866 on Regulatory Planning and $10 million or less based on Small certain requirements that an agency
Review (September 30, 1993), Executive Business Administration size standards. must meet when it promulgates a final
Order 13563 on Improving Regulation Approximately 95 percent of physicians rule that imposes substantial direct
and Regulatory Review (January 18, are considered to be small entities. We requirement costs on State and local
2011), the Regulatory Flexibility Act estimate that most hospitals and most governments, preempts State law, or
(RFA) (September 19, 1980, Pub. L. 96– other providers are small entities as that otherwise has Federalism implications.
354), section 1102(b) of the Social term is used in the RFA (including We have examined this final rule in
Security Act, section 202 of the small businesses, nonprofit accordance with Executive Order 13132
Unfunded Mandates Reform Act of 1995 organizations, and small governmental and have determined that this
(March 22, 1995, Pub. L. 104–4), jurisdictions). However, because the regulation would not have any
Executive Order 13132 on Federalism total estimated impact would be spread substantial direct effect on State or local
(August 4, 1999), and the Congressional over a number of providers and governments, preempt States, or
Review Act (5 U.S.C. 804(2)). suppliers, no one entity would face a otherwise have a Federalism
Executive Orders 12866 and 13563 significant impact. Additionally, as implication.
direct agencies to assess all costs and CMS has reduced the cost of the data for
benefits of available regulatory qualified entities, we do not anticipate C. Anticipated Effects
alternatives and, if regulation is that this rule will have a significant a. Impact on Qualified Entities
necessary, to select regulatory impact on qualified entities. Therefore,
approaches that maximize net benefits the Secretary has determined this final Because section 1874(e) of the Act
(including potential economic, rule would not have a significant impact establishes a new program, there is little
environmental, public health and safety on a substantial number of small quantitative information available to
effects, distributive impacts, and entities. We have voluntarily provided inform our estimates. However, we
equity). Executive Order 13563 an analysis of the estimated impacts on believe that many or most qualified
emphasizes the importance of qualified entities and providers and entities are likely to resemble
quantifying both cost and benefits, suppliers below in section V.C., as well community quality collaborative
reducing costs, harmonizing rules, and as alternatives considered in section programs such as participants in the
promoting flexibility. A regulatory V.D. CMS Better Quality Information for
impact analysis (RIA) must be prepared In addition, section 1102(b) of the Act Medicare Beneficiaries pilot (https://
for major rules with economically requires us to prepare a regulatory [Link]/BQI/) and the AHRQ
significant effects ($100 million or more impact analysis, if a rule may have a Chartered Value Exchange (CVE)
in any 1 year). This final rule is not significant impact on the operations of program ([Link]
economically significant as measured by a substantial number of small rural value/[Link]). Community
the $100 million threshold, and hence hospitals. Any such regulatory impact quality collaboratives are community-
not a major rule under the analysis must conform to the provisions based organizations of multiple
Congressional Review Act. We estimate of section 604 of the RFA. For purposes stakeholders that work together to
the total impact of this final rule to be of section 1102(b) of the Act, we define transform health care at the local level
approximately $86 million. We a small rural hospital as a hospital that by promoting quality and efficiency of
provided a detailed assessment of the is located outside of a metropolitan care, and by measuring and publishing
impacts associated with this final rule, statistical area and has fewer than 100 quality information. Consequently, we
as noted below. beds. We do not believe this final rule have examined available information
The RFA requires agencies to analyze has impact on significant operations of related to those programs to inform our
options for regulatory relief of small a substantial number of small rural assumptions, although there is only
businesses, if a rule has a significant hospitals because we anticipate that limited available data that is directly
impact on a substantial number of small most qualified entities would focus their applicable to this analysis.
entities. We estimate that two types of performance evaluation efforts on We estimate that 35 organizations
entities may be affected by the program metropolitan areas where the majority of would submit applications to
established by section 1874(e) of the participate as qualified entities. We
emcdonald on DSK5VPTVN1PROD with RULES2

health services are provided. Therefore,

Act: Organizations that desire to operate the Secretary has determined that this anticipate that the majority of applicants
as qualified entities and the providers final rule would not have a significant would be nonprofit organizations such
and suppliers who receive performance impact on the operations of a substantial as existing community collaboratives. In
reports from qualified entities. We number of small rural hospitals. estimating qualified entity impacts, we
anticipate that most providers and Section 202 of the Unfunded used hourly labor costs in several labor
suppliers receiving qualified entities’ Mandates Reform Act of 1995 (UMRA) categories reported by the Bureau of
performance reports would be hospitals also requires that agencies assess Labor Statistics (BLS) at http://

VerDate Mar<15>2010 17:17 Dec 06, 2011 Jkt 226001 PO 00000 Frm 00023 Fmt 4701 Sfmt 4700 E:\FR\FM\[Link] 07DER2
 76564 Federal Register / Vol. 76, No. 235 / Wednesday, December 7, 2011 / Rules and Regulations

[Link]/pdq/ the proposed rule where we used rates overhead and fringe benefit costs. These
[Link]?survey=ce. We used the from 2009, and added 33 percent for rates are displayed in Table 2.
annual rates for 2010, an update from

TABLE 2—LABOR RATES FOR QUALIFIED ENTITY IMPACT ESTIMATES

2010 hourly OH and fringe Total hourly
wage rate (33%) costs
(BLS)

Professional & technical services ................................................................................................ $34.63 $11.43 $46.06

Legal review ................................................................................................................................. 35.98 11.87 47.85
Custom computer programming .................................................................................................. 40.50 13.37 53.87
Data processing & hosting .......................................................................................................... 31.57 10.42 41.99
Other information services ........................................................................................................... 33.55 11.07 44.62

We estimate that preparation of an Medicare claims data, calculate average however, we believe that this is
application would require a total of 500 performance measures and produce a realistic and reasonable estimate of the
hours of effort, requiring a combination provider and supplier performance burden of the appeals process on
of staff in the professional and technical reports would require 5,500 hours of qualified entities. We discuss the
services and the legal labor categories. effort. We estimate that half of the burden of the appeals process on
We estimate that 25 of these qualified entities (13) would propose providers and suppliers below.
applicants would be approved as alternative performance measures, We anticipate that qualified entities
participating qualified entities, and that which would involve an additional would expend 2,000 hours of effort
each qualified entity would request 2,100 hours of effort for each entity. developing their proposed performance
Medicare claims data accompanied by report. These estimated hours are
payment for these data. Because of the We further estimate that, on average,
each qualified entity would expend separated into labor categories in Table
eligibility criteria we are proposing for 3 below, with the pertinent hourly labor
qualified entities, we believe that it is 5,000 hours of effort processing
providers’ and suppliers’ appeals of rates and cost totals.
likely that all of these organizations
would already be performing work their performance reports and Finally, we estimate that each
related to calculation of quality producing revised reports, and 2,000 qualified entity would spend 255 hours
measures and production of hours making information about the of effort submitting information to CMS
performance reports for health care performance measures publicly for monitoring purposes. This would
providers and suppliers, so the impact available. These estimates assume that, include audits and site visits as
of the program established by section as discussed below in the section on discussed above. It would also include
1874(e) of the Act would be an provider and supplier impacts, on an annual report that contains measures
opportunity to add Medicare claims average 25 percent of providers and of general program adherence, measures
data to their existing function. suppliers would appeal their results of the provider and suppliers data
The statute directs that the fees for from a qualified entity. These sharing, error correction, and appeals
these data be equal to the government’s assumptions are based on a belief that process, and measures of the success of
cost to make the data available. We are in the first year of the program many the program with consumers. Finally,
proposing to initially provide ten providers or suppliers would want to qualified entities would be required to
quarters of data to qualified entities appeal their results prior to performance notify CMS of inappropriate disclosures
with quarterly updates thereafter. Based reports being made available to the or use of beneficiary identifiable data
on CMS past experience providing public. Responding to these appeals in pursuant to the requirements in the
Medicare data to research entities, we an appropriate manner would require a DUA. We believe that many of the
estimate that the total approximate costs significant investment of time on the required data elements in both the
to provide ten quarters (CY 2009, CY part of qualified entities. This equates to annual report and the report generated
2010, and Q1–Q2 CY2011) of data for an average of four hours per appeal for in response to an inappropriate
2.5 million beneficiaries to a qualified each qualified entity. We assume that disclosure or use of beneficiary
entity would be $24,000. Qualified the complexity of appeals would vary identifiable data would be generated as
entities would also get 2 quarterly greatly, and as such, the time required a matter of course by the qualified
updates, each for a fee of $8,000, during to address them would also vary greatly. entities and therefore, would not require
the year, bringing the total cost of data Many appeals may be able to be dealt significant additional effort. Based on
for the first year of the program to with in an hour or less while some the assumptions we have described, we
$40,000 as shown in Table 3. appeals may require multiple meetings estimate the total impact on qualified
We estimate that, on average, each between the qualified entity and the entities for the first year of the program
qualified entity’s activity to analyze the affected provider or supplier. On to be a cost of $45,504,048.
emcdonald on DSK5VPTVN1PROD with RULES2

VerDate Mar<15>2010 17:17 Dec 06, 2011 Jkt 226001 PO 00000 Frm 00024 Fmt 4701 Sfmt 4700 E:\FR\FM\[Link] 07DER2
 Federal Register / Vol. 76, No. 235 / Wednesday, December 7, 2011 / Rules and Regulations 76565

TABLE 3—IMPACT ON QUALIFIED ENTITIES FOR THE FIRST YEAR OF THE PROGRAM
[Impact on qualified entities]

Hours
Labor hourly Cost Number of Total cost
Activity Data
Professional Computer cost per applicant applicants impact
Legal processing
and technical programming and hosting

APPLICATION COSTS

Preparation of application
by candidate qualified
entities
a. Prepare draft application 360 ........................ ........................ ........................ $46.06 $16,582 ........................ ........................
b. Legal review .................. ........................ 40 ........................ ........................ 47.85 1,914 ........................ ........................
c. Revisions to draft appli-
cation ............................. 60 ........................ ........................ ........................ 46.06 2,764 ........................ ........................
d. Senior management re-
view and signature ........ 40 ........................ ........................ ........................ 46.06 1,842 ........................ ........................
Total: application prepara-
tion ................................. 460 40 ........................ ........................ ........................ 23,102 35 $808,556
Medicare data purchase
costs by approved quali-
fied entities .................... ........................ ........................ ........................ ........................ ........................ 40,000 25 1,000,000

Total: Applications ...... ........................ ........................ ........................ ........................ ........................ ........................ ........................ 1,808,556

QE OPERATIONS COSTS

Database administration ... ........................ ........................ ........................ 500 41.99 20,995 25 524,875
Data analysis/measure cal-
culation/report prepara-
tion ................................. ........................ ........................ 2500 ........................ 53.87 134,675 25 3,366,875
2500 41.99 104,975 25 2,624,375
Development and submis-
sion of alternative meas-
ures ................................ 1000 ........................ ........................ ........................ 46.06 46,060 13 598,780
100 1000 53.87 5,387 13 70,031
41.99 41,990 13 545,870
Qualified entity processing
of provider or supplier
appeals and report revi-
sion ................................ 4000 ........................ ........................ ........................ 46.06 184,240 25 4,606,000
1000 47.85 47,850 25 1,196,250
Development of proposed
performance report for-
mats ............................... 1000 ........................ ........................ ........................ 46.06 46,060 25 1,151,500
1000 53.87 53,870 25 1,346,750
Publication of performance
reports ............................ ........................ ........................ 1000 ........................ 53.87 53,870 25 1,346,750
1000 41.99 41,990 25 1,049,750
Monitoring .......................... ........................ ........................ ........................ 255 41.99 10,707 25 267,686
Computer hardware and
processing ..................... ........................ ........................ ........................ ........................ ........................ 1,000,000 25 25,000,000

Total: Operations ....... ........................ ........................ ........................ ........................ ........................ ........................ ........................ 43,695,492

TOTAL QUALI-
FIED ENTITY
IMPACTS (ap-
plication plus
operations) ...... ........................ ........................ ........................ ........................ ........................ ........................ ........................ 45,504,048

b. Impact on Health Care Providers and producing performance measures for acknowledge that reviewing and
Suppliers health care providers and suppliers appealing the reports will be a burden
Table 4 reflects the hourly labor rates using data from other sources, and that for providers and suppliers, we also
used in our estimate of the impacts of providers and suppliers are already note that there are many benefits of this
the first year of section 1874(e) of the receiving performance reports from program for providers and suppliers, as
Act on health care providers and these sources. We anticipate that the well as the Medicare program,
suppliers, as well as the professional Medicare claims data would merely be consumers, and purchasers. As a result
and technical services of consultants. added to those existing efforts to of this program, providers and suppliers
emcdonald on DSK5VPTVN1PROD with RULES2

The rates in Table 4 are for 2010 and improve the statistical validity of the will likely receive one report covering a
have been updated from the proposed measure findings, and therefore the majority of their patients, rather than a
rule where we used rates for 2009. We impact of including Medicare claims report from each payer. Furthermore,
note that numerous health care payers, data in these existing performance the transparency of performance results
community quality collaboratives, reporting processes is likely to be will help providers and suppliers
States, and other organizations are marginal. Additionally, while we improve quality and reduce costs.

VerDate Mar<15>2010 17:17 Dec 06, 2011 Jkt 226001 PO 00000 Frm 00025 Fmt 4701 Sfmt 4700 E:\FR\FM\[Link] 07DER2
 76566 Federal Register / Vol. 76, No. 235 / Wednesday, December 7, 2011 / Rules and Regulations

TABLE 4—LABOR RATES FOR PROVIDER AND SUPPLIER IMPACT ESTIMATES

2010 hourly Overhead and Total hourly
wage rate fringe benefits costs
(BLS) (33%)

Labor Rates for Provider and Supplier Impact Estimates

Physicians’ offices ..................................................................................................... $32.24 $10.64 $42.88

Hospitals .................................................................................................................... 27.42 9.05 36.47
Professional and technical services .......................................................................... 34.63 11.43 46.06

We anticipate that the impacts on and other suppliers. Providers and required by qualified entities in
providers and suppliers consist of costs suppliers receive these reports with no operating the appeals process, we
to review the performance reports obligation to review them, but we believe that this average covers a range
generated by qualified entities and, if assume that most would do so to verify of provider and supplier efforts from
they choose, appeal their performance that their calculated performance those who would need just one or two
calculations. Based on a review of measures reflect their actual patients hours to clarify any questions or
available information from the Better and health events. We estimate that, on concerns regarding their performance
Quality Information and the Charter average, each provider or supplier reports to those who would devote
Value Exchange programs, we estimate would devote five hours to reviewing significant time and resources to the
that, on average, each qualified entity these reports. This average reflects that appeals process.
would distribute performance reports to some providers and suppliers will Using the hourly costs displayed in
5,000 health providers and suppliers. spend less than half an hour reviewing Table 4, the impacts on providers and
We anticipate that the largest proportion reports, while others may spend 10 suppliers are calculated below in Table
of providers and suppliers would be hours. 5. Based on the assumptions we have
physicians because they comprise the We estimate that 25 percent of the described, we estimate the total impact
largest group of providers and suppliers, providers and suppliers would decide to on providers and suppliers for the first
and are a primary focus of many recent appeal their performance calculations, year of the program to be a cost of
performance evaluation efforts. Based and that preparing the appeal would $40,458,400.
on our review of information from these involve an average of ten hours of effort As stated above in Table 3, we
existing programs, we assume that 95 on the part of a provider or supplier. We estimate the total impact on qualified
percent of the recipients of performance assume that 50 percent of the providers entities to be a cost of $45,504,048.
reports (that is, an average of 4,750 per and suppliers who decide to appeal Therefore, the total impact on qualified
qualified entity) would be physicians, would hire consultants to assist with the entities and on providers and suppliers
and 5 percent (that is, an average of 250 appeals process. As with our for the first year of the program is
per qualified entity) would be hospitals assumptions regarding the level of effort estimated to be $85,962,448.

TABLE 5—IMPACT ON PROVIDERS AND SUPPLIERS FOR THE FIRST YEAR OF THE PROGRAM
Hours per provider Number of Number of
Labor hourly Cost per providers Total cost
Activity Professional qualified
Physician cost applicant per qualified impact
Hospitals and entities
offices entity
technical

Impact on Providers and Suppliers

Provider review of per-

formance reports .......... 5 .................... .................... $42.88 $214 4,750 25 $25,460,000
.................... 5 .................... 36.47 182 250 25 1,139,688
Preparing and submitting
appeal request to quali-
fied entities ................... 10 .................... .................... 42.88 429 594 25 6,367,680
.................... 10 .................... 36.47 365 31 25 282,643
.................... .................... 10 46.06 461 626 25 7,208,390

Total provider im-

pacts ...................... .................... .................... .................... .................... .................... .................... .................... 40,458,400

D. Alternatives Considered considered proposing a less security protection). While such an

The statutory provisions that were comprehensive set of eligibility criteria approach might have reduced certain
emcdonald on DSK5VPTVN1PROD with RULES2

added by section 1874(e) of the Act are for qualified entities (for example, application and operating costs for these
detailed and prescriptive about the eliminating requirements that entities, we did not adopt such an
eligibility for, and requirements of the applicants demonstrate capabilities approach for several reasons. An
qualified entity program. Consequently, related to calculation of measures, important consideration is the
we believe there are limited alternative developing performance reports, protection of beneficiary identifiable
approaches that would ensure program combining Medicare claims data with data. We believe if we do not require
success and statutory compliance. We other claims, and data privacy and qualified entities to provide sufficient

VerDate Mar<15>2010 18:13 Dec 06, 2011 Jkt 226001 PO 00000 Frm 00026 Fmt 4701 Sfmt 4700 E:\FR\FM\[Link] 07DER2
 Federal Register / Vol. 76, No. 235 / Wednesday, December 7, 2011 / Rules and Regulations 76567

evidence of data privacy and security 401.719 Monitoring and sanctioning of or any other direct identifying factors,
protection capabilities, there would be qualified entities. but does include a unique CMS-
increased risks related to the protection 401.721 Terminating an agreement with a assigned beneficiary identifier that
of beneficiary identifiable data. qualified entity. allows for the linking of claims without
Additionally, we believe that Subpart G—Availability of Medicare divulging any direct identifier of the
requiring less stringent requirements beneficiary.
Data for Performance Measurement
regarding the production and reporting (h) Claims data from other sources
of measures would lead to increases in § 401.701 Purpose and scope. means provider- or supplier-identifiable
the number of provider and supplier The regulations in this subpart claims data that an applicant or
appeals, and consequently in appeals- implement section 1874(e) of the Social qualified entity has full data usage right
related costs for providers, suppliers Security Act as it applies to Medicare to due to its own operations or
and qualified entities. We expect that data made available to qualified entities disclosures from providers, suppliers,
such a scenario would not support the for the evaluation of the performance of private payers, multi-payer databases, or
development of a cooperative providers and suppliers. other sources.
relationship between qualified entities (i) Clinical data is registry data, chart-
and providers and suppliers. § 401.703 Definitions. abstracted data, laboratory results,
For purposes of this subpart: electronic health record information, or
E. Conclusion (a) Qualified entity means either a other information relating to the care or
As explained above, we estimate the single public or private entity, or a lead services furnished to patients that is not
total impact for the first year of the entity and its contractors, that meets the included in administrative claims data,
program on qualified entities, providers following requirements: but is available in electronic form.
and suppliers to be a cost of (1) Is qualified, as determined by the
§ 401.705 Eligibility criteria for qualified
$85,962,448. Based on these estimates, Secretary, to use claims data to evaluate entities.
we conclude this final rule does not the performance of providers and
suppliers on measures of quality, (a) Eligibility criteria: To be eligible to
reach the threshold for economically apply to receive data as a qualified
significant effects and thus is not efficiency, effectiveness, and resource
entity under this subpart, an applicant
considered a major rule. use.
(2) Agrees to meet the requirements generally must demonstrate expertise
In accordance with the provisions of and sustained experience, defined as 3
Executive Order 12866, this regulation described in this subpart at §§ 401.705
through 401.721. or more years, in the following three
was reviewed by the Office of areas, as applicable and appropriate to
Management and Budget. (b) Provider of services (referred to as
a provider) has the same meaning as the the proposed use:
List of Subjects in 42 CFR Part 401 term ‘‘provider’’ in § 400.202 of this (1) Organizational and governance
criteria, including:
Claims, Freedom of information, chapter.
(i) Expertise in the areas of
Health facilities, Medicare, Privacy. (c) Supplier has the same meaning as
measurement that they propose to use in
the term ‘‘supplier’’ at § 400.202 of this
For the reasons set forth in the accurately calculating quality, and
chapter.
preamble, the Centers for Medicare & (d) Claim means an itemized billing efficiency, effectiveness, or resource use
Medicaid Services amends 42 CFR statement from a provider or supplier measures from claims data, including
chapter IV as set forth below: that, except in the context of Part D the following:
(A) Identifying an appropriate method
prescription drug event data, requests
PART 401—GENERAL to attribute a particular patient’s
payment for a list of services and
ADMINISTRATIVE REQUIREMENTS services to specific providers and
supplies that were furnished to a suppliers.
■ 1. The authority citation for part 401 Medicare beneficiary in the Medicare (B) Ensuring the use of approaches to
is revised to read as follows: fee-for-service context, or to a ensure statistical validity such as a
participant in other insurance or minimum number of observations or
Authority: Secs. 1102, 1871, and 1874(e) of entitlement program contexts. In the
the Social Security Act (42 U.S.C. 1302, minimum denominator for each
Medicare program, claims files are measure.
1395hh, and 1395w–5).
available for each institutional (C) Using methods for risk-adjustment
■ 2. A new subpart G is added to part (inpatient, outpatient, skilled nursing to account for variations in both case-
401 to read as follows: facility, hospice, or home health agency) mix and severity among providers and
Subpart G—Availability of Medicare Data for and non-institutional (physician and suppliers.
Performance Measurement durable medical equipment providers (D) Identifying methods for handling
Sec. and suppliers) claim type as well as outliers.
401.701 Purpose and scope. Medicare Part D Prescription Drug Event (E) Correcting measurement errors
401.703 Definitions. (PDE) data. and assessing measure reliability.
401.705 Eligibility criteria for qualified (e) Standardized data extract is a (F) Identifying appropriate peer
entities. subset of Medicare claims data that the groups of providers and suppliers for
401.707 Operating and governance Secretary would make available to meaningful comparisons.
requirements for qualified entities. qualified entities under this subpart. (ii) A plan for a business model that
401.709 The application process and (f) Beneficiary identifiable data is any is projected to cover the costs of
requirements. data that contains the beneficiary’s
emcdonald on DSK5VPTVN1PROD with RULES2

performing the required functions,

401.711 Updates to plans submitted as part name, Medicare Health Insurance Claim
of the application process.
including the fee for the data.
401.713 Ensuring the privacy and security
Number (HICN), or any other direct (iii) Successfully combining claims
of data. identifying factors, including, but not data from different payers to calculate
401.715 Selection and use of performance limited to postal address or telephone performance reports.
measures. number. (iv) Designing, and continuously
401.717 Provider and supplier requests for (g) Encrypted data is any data that improving the format of performance
error correction. does not contain the beneficiary’s name reports on providers and suppliers.

VerDate Mar<15>2010 18:13 Dec 06, 2011 Jkt 226001 PO 00000 Frm 00027 Fmt 4701 Sfmt 4700 E:\FR\FM\[Link] 07DER2
 76568 Federal Register / Vol. 76, No. 235 / Wednesday, December 7, 2011 / Rules and Regulations

(v) Preparing an understandable § 401.707 Operating and governance § 401.709 The application process and
description of the measures used to requirements for qualified entities. requirements.
evaluate the performance of providers A qualified entity must meet the (a) Application deadline. CMS accepts
and suppliers so that consumers, following operating and governance qualified entity applications on a rolling
providers and suppliers, health plans, requirements: basis after an application is made
researchers, and other stakeholders can (a) Submit to CMS a list of all available on the CMS Web site. CMS
assess performance reports. measures it intends to calculate and reviews applications in the order in
(vi) Implementing and maintaining a report, the geographic areas it intends to which they are received.
serve, and the methods of creating and (b) Selection criteria. To be approved
process for providers and suppliers
disseminating reports. This list must as a qualified entity under this subpart,
identified in a report to review the
include the following information, as the applicant must meet one of the
report prior to publication and
applicable and appropriate to the following:
providing a timely response to provider (1) Standard approval process: Meet
and supplier inquiries regarding proposed use:
(1) Name of the measure, and whether the eligibility and operational and
requests for data, error correction, and governance requirements, fulfill all of
appeals. it is a standard or alternative measure.
(2) Name of the measure developer/ the application requirements to CMS’
(vii) Establishing, maintaining, and owner. satisfaction, and agree to pay a fee equal
monitoring a rigorous data privacy and (3) If it is an alternative measure, to the cost of CMS making the data
security program, including disclosing measure specifications, including available. The applicant and each of its
to CMS any inappropriate disclosures of numerator and denominator. contractors that are anticipated to have
beneficiary identifiable information, (4) The rationale for selecting each access to the Medicare data must also
violations of applicable federal and measure, including the relationship to execute a Data Use Agreement with
State privacy and security laws and existing measurement efforts and the CMS, that among other things, reaffirms
regulations for the preceding 10-year relevancy to the population in the the statutory ban on the use of Medicare
period (or, if the applicant has not been geographic area(s) the entity would data provided to the qualified entity by
in existence for 10 years, the length of serve, including the following: CMS under this subpart for purposes
time the applicant has been an (i) A specific description of the other than those referenced in this
organization), and any corrective actions geographic area or areas it intends to subpart.
taken to address the issues. serve. (2) Conditional approval process:
(viii) Accurately preparing (ii) A specific description of how each Meet the eligibility and operational and
performance reports on providers and measure evaluates providers and governance requirements, and fulfill all
suppliers and making performance suppliers on quality, efficiency, of the application requirements to CMS’
report information available to the effectiveness, and/or resource use. satisfaction, with the exception of
public in aggregate form, that is, at the (5) A description of the methodologies possession of sufficient claims data from
it intends to use in creating reports with other sources. Meeting these
provider or supplier level.
respect to all of the following topics: requirements will result in a conditional
(2) Expertise in combining Medicare approval as a qualified entity. Entities
(i) Attribution of beneficiaries to
claims data with claims data from other gaining a conditional approval as a
providers and/or suppliers.
sources, including demonstrating to the (ii) Benchmarking performance data, qualified entity must meet the eligibility
Secretary’s satisfaction that the claims including the following: requirements related to claims data from
data from other sources that it intends (A) Methods for creating peer groups. other sources the entity intends to
to combine with the Medicare data (B) Justification of any minimum combine with the Medicare data, agree
received under this subpart address the sample size determinations made. to pay a fee equal to the cost of CMS
methodological concerns regarding (C) Methods for handling statistical making the data available, and execute
sample size and reliability that have outliers. a Data Use Agreement with CMS, that
been expressed by stakeholders (iii) Risk adjustment, where among other things, reaffirms the
regarding the calculation of performance appropriate. statutory ban on the use of Medicare
measures from a single payer source. (iv) Payment standardization, where data provided to the qualified entity by
(3) Expertise in establishing, appropriate. CMS under this subpart for purposes
documenting and implementing (b) Submit to CMS a description of the other than those referenced in this
rigorous data privacy and security process it would establish to allow subpart before receiving any Medicare
policies including enforcement providers and suppliers to view reports data. If the qualified entity is composed
mechanisms. confidentially, request data, and ask for of lead entity with contractors, any
(b) Source of expertise and the correction of errors before the contractors that are anticipated to have
experience: An applicant may reports are made public. access to the Medicare data must also
demonstrate expertise and experience in (c) Submit to CMS a prototype report execute a Data Use Agreement with
any or all of the areas described in and a description of its plans for making CMS.
the reports available to the public. (c) Duration of approval. CMS permits
paragraph (a) of this section through one
(d) Submit to CMS information about an entity to participate as a qualified
of the following:
the claims data it possesses from other entity for a period of 3 years from the
(1) Activities it has conducted directly sources, as defined at § 401.703(h), and date of notification of the application
through its own staff. documentation of adequate rights to use approval by CMS. The qualified entity
emcdonald on DSK5VPTVN1PROD with RULES2

(2) Contracts with other entities if the the other claims data for the purposes of must abide by all CMS regulations and
applicant is the lead entity and includes this subpart. instructions. If the qualified entity
documentation in its application of the (e) If requesting a 5 percent national wishes to continue performing the tasks
contractual arrangements that exist sample to calculate benchmarks for the after the 3-year approval period, the
between it and any other entity whose specific measures it is using, submit to entity may re-apply for qualified entity
expertise and experience is relied upon CMS a justification for needing the file status following the procedures in
in submitting the application. to calculate benchmarks. paragraph (f) of this section.

VerDate Mar<15>2010 18:13 Dec 06, 2011 Jkt 226001 PO 00000 Frm 00028 Fmt 4701 Sfmt 4700 E:\FR\FM\[Link] 07DER2
 Federal Register / Vol. 76, No. 235 / Wednesday, December 7, 2011 / Rules and Regulations 76569

(d) Reporting period. A qualified days before its intended confidential and comply with the DUA. The DUA
entity must produce reports on the release to providers and suppliers. will require the qualified entity to
performance of providers and suppliers (2) Its proposed prototype report—the maintain privacy and security protocols
at least annually, beginning in the qualified entity must send the new throughout the duration of the
calendar year after they are approved by prototype report to CMS at least 30 days agreement with CMS and will ban the
CMS. before its intended confidential release use of data for purposes other than those
(e) The distribution of data.—(1) to providers and suppliers. set out in this subpart. The DUA will
Initial data release. Once CMS fully (3) Its plans for sharing the reports also prohibit the use of unsecured
approves a qualified entity under this with the public—the qualified entity telecommunications to transmit CMS
subpart, the qualified entity must pay a must send the new plans to CMS at least data and will specify the circumstances
fee equal to the cost of CMS making data 30 days before its intended confidential under which CMS data must be stored
available. After the qualified entity pays release to providers and suppliers. and transmitted.
the fee, CMS will release the applicable (b) CMS will notify the qualified (b) A qualified entity must inform
encrypted claims data, as well as a file entity when the entity’s proposed each beneficiary whose beneficiary
that crosswalks the encrypted changes are approved or denied for use, identifiable data has been (or is
beneficiary ID to the beneficiary name generally within 30 days of the qualified reasonably believed to have been)
and the Medicare HICN. The data will entity submitting the changes to CMS. If inappropriately accessed, acquired, or
be the most recent data available, and a CMS decision on approval or disclosed in accordance with the DUA.
will be limited to the geographic spread disapproval for a change is not (c) Contractor(s) must report to the
of the qualified entity’s other claims forthcoming within 30 days and CMS qualified entity whenever there is an
data, as determined by CMS. does not request an additional 30 days incident where beneficiary identifiable
(2) Subsequent data releases. After for review, the change or modification data has been (or is reasonably believed
the first quarter of participation, CMS shall be deemed to be approved. to have been) inappropriately accessed,
will provide a qualified entity with the (c) If the amount of claims data from acquired, or disclosed.
most recent additional quarter of other sources available to a qualified
currently available data, as well as a entity decreases, the qualified entity § 401.715 Selection and use of
table that crosswalks the encrypted must immediately inform CMS and performance measures.
beneficiary ID to the beneficiary’s name submit documentation that the (a) Standard measures. A standard
and the Medicare HICN. Qualified remaining claims data from other measure is a measure that can be
entities are required to pay CMS a fee sources is sufficient to address the calculated in full or in part from claims
equal to the cost of making data methodological concerns regarding data from other sources and the
available before CMS will release the sample size and reliability. Under no standardized extracts of Medicare Parts
most recent quarter of additional data to circumstances may a qualified entity A and B claims, and Part D prescription
the qualified entity. use Medicare data to create a report, use drug event data and meets the following
(f) Re-application. A qualified entity a measure, or share a report after the requirements:
that is in good standing may re-apply for amount of claims data from other (1) Meets one of the following criteria:
qualified entity status. A qualified entity sources available to a qualified entity (i) Is endorsed by the entity with a
is considered to be in good standing if decreases until CMS determines either contract under section 1890(a) of the
it has had no violations of the that the remaining claims data is Social Security Act.
requirements in this subpart or if the sufficient or that the qualified entity has (ii) Is time-limited endorsed by the
qualified entity is addressing any past collected adequate additional data to entity with a contract under section
deficiencies either on its own or through address any deficiencies. 1890(a) of the Social Security Act until
the implementation of a corrective (1) If the qualified entity cannot such time as the full endorsement status
action plan. To re-apply a qualified submit the documentation required in is determined.
entity must submit to CMS paragraph (c) of this section, or if CMS (iii) Is developed under section 931 of
documentation of any changes to what determines that the remaining claims the Public Health Service Act.
was included in its previously-approved data is not sufficient, CMS will afford (iv) Can be calculated from
application. A re-applicant must submit the qualified entity up to 120 days to standardized extracts of Medicare Parts
this documentation at least 6 months obtain additional claims to address any A or B claims or Part D prescription
before the end of its 3-year approval deficiencies. If the qualified entity does drug event data, was adopted through
period and will be able to continue to not have access to sufficient new data notice-and-comment rulemaking, and is
serve as a qualified entity until the re- after that time, CMS will terminate its currently being used in CMS programs
application is either approved or denied relationship with the qualified entity. that include quality measurement.
(2) If CMS determines that the (v) Is endorsed by a CMS-approved
by CMS. If the re-application is denied,
remaining claims data is sufficient, the consensus-based entity. CMS will
CMS will terminate its relationship with
qualified entity may continue issuing approve organizations as consensus-
the qualified entity and the qualified
reports, using measures, and sharing based entities based on review of
entity will be subject to the
reports. documentation of the consensus-based
requirements for return or destruction of
entity’s measure approval process. To
data at § 401.721(b).
§ 401.713 Ensuring the privacy and receive approval as a consensus-based
§ 401.711 Updates to plans submitted as security of data. entity, an organization must submit
part of the application process. (a) A qualified entity must comply information to CMS documenting its
emcdonald on DSK5VPTVN1PROD with RULES2

(a) If a qualified entity wishes to make with the data requirements in its data processes for stakeholder consultation
changes to the following parts of its use agreement (DUA) with CMS. and measures approval; an organization
previously-approved application: Contractors of qualified entities that are will only receive approval as a
(1) Its list of proposed measures—the anticipated to have access to the consensus-based entity if all measure
qualified entity must send all the Medicare claims data or beneficiary specifications are publically available.
information referenced in § 401.707(a) identifiable data in the context of this An organization will retain CMS
for the new measures to CMS at least 30 program are also required to execute acceptance as a consensus-based entity

VerDate Mar<15>2010 18:13 Dec 06, 2011 Jkt 226001 PO 00000 Frm 00029 Fmt 4701 Sfmt 4700 E:\FR\FM\[Link] 07DER2
 76570 Federal Register / Vol. 76, No. 235 / Wednesday, December 7, 2011 / Rules and Regulations

for 3 years after the approval date, at of this section may be used by any another qualified entity, no new
which time CMS will review new qualified entity. An alternative measure scientific evidence on the measure is
documentation of the consensus-based approved under the process at available, and the subsequent qualified
entity’s measure approval process for a paragraph (b)(1)(ii) of this section may entity wishes to rely upon the scientific
new 3-year approval. only be used by the qualified entity that evidence submitted by the previously
(2) Is used in a manner that follows submitted the measure for consideration approved applicant, an explanation
the measure specifications as written (or by the Secretary. A qualified entity may backed by scientific evidence that
as adopted through notice-and-comment use an alternative measure up until the demonstrates why the measure is more
rulemaking), including all numerator point that an equivalent standard valid, reliable, responsive to consumer
and denominator inclusions and measure for the particular clinical area preferences, cost-effective, or relevant to
exclusions, measured time periods, and or condition becomes available at which dimensions of quality and resource use
specified data sources. point the qualified entity must switch to not addressed by a standard measure.
(b) Alternative measure. (1) An the standard measure within 6 months
alternative measure is a measure that is or submit additional scientific § 401.717 Provider and supplier requests
not a standard measure, but that can be for error correction.
justification and receive approval, via
calculated in full, or in part, from claims either paragraphs (b)(1)(i) or (b)(1)(ii) of (a) A qualified entity must
data from other sources and the this section, from the Secretary to confidentially share measures,
standardized extracts of Medicare Parts continue using the alternative measure. measurement methodologies, and
A and B claims, and Part D prescription (3) To submit an alternative measure measure results with providers and
drug event data, and that meets one of for consideration under the notice-and- suppliers at least 60 calendar days
the following criteria: comment-rulemaking process, for use in before making reports public. The 60
(i) Rulemaking process: Has been the calendar year following the calendar days begin on the date on
found by the Secretary, through a submission, an entity must submit the which qualified entities send the
notice-and comment-rulemaking following information by May 31st: confidential reports to providers and
process, to be more valid, reliable, (i) The name of the alternative suppliers. A qualified entity must
responsive to consumer preferences, measure. inform providers and suppliers of the
cost-effective, or relevant to dimensions (ii) The name of the developer or date the reports will be made public at
of quality and resource use not owner of the alternative measure. least 60 calendar days before making the
addressed by standard measures, and is (iii) Detailed specifications for the reports public.
used by a qualified entity in a manner alternative measure. (b) Before making the reports public,
that follows the measure specifications (iv) Evidence that use of the a qualified entity must allow providers
as adopted through notice-and-comment alternative measure would be more and suppliers the opportunity to make
rulemaking, including all numerator valid, reliable, responsive to consumer a request for the data, or to make a
and denominator inclusions and preferences, cost-effective, or relevant to request for error correction, within 60
exclusions, measured time periods, and dimensions of quality and resource use calendar days after sending the
specified data sources. not addressed by standard measures. confidential reports to providers or
(ii) Stakeholder consultation approval (4) To submit an alternative measure suppliers.
process: Has been found by the for consideration under the
Secretary, using documentation (c) During the 60 calendar days
documentation of stakeholder between sending a confidential report
submitted by a qualified entity that consultation approval process described
outlines its consultation and agreement on measure results and releasing the
in paragraph (b)(1)(ii) of this section, for report to the public, the qualified entity
with stakeholders in its community, to use once the measure is approved by the
be more valid, responsive to consumer must, at the request of a provider or
Secretary, an entity must submit the supplier and with appropriate privacy
preferences, cost-effective, or relevant to following information to CMS:
dimensions of quality and resource use and security protections, release the
(i) The name of the alternative Medicare claims data and beneficiary
not addressed by standard measures, measure.
and is used by a qualified entity in a names to the provider or supplier.
(ii) The name of the developer or
manner that follows the measure Qualified entities may only provide the
owner of the alternative measure.
specifications as submitted, including (iii) Detailed specifications for the Medicare claims and/or beneficiary
all numerator and denominator alternative measure. names relevant to the particular
inclusions and exclusions, measured (iv) A description of the process by measure or measure result the provider
time periods, and specified data which the qualified entity notified or supplier is appealing.
sources. If a CMS decision on approval stakeholders in the geographic region it (d) A qualified entity must inform
or disapproval of alternative measures serves of its intent to seek approval of providers and suppliers that reports will
submitted using the stakeholder an alternative measure. Stakeholders be made public, including information
consultation approval process is not must include a valid cross related to the status of any data or error
forthcoming within 60 days of representation of providers, suppliers, correction requests, after the date
submission of the measure by the payers, employers, and consumers. specified to the provider or supplier
qualified entity, the measure will be (v) A list of stakeholders from whom when the report is sent for review and,
deemed approved. However, CMS feedback was solicited, including the if necessary, error correction requests (at
retains the right to disapprove a stakeholders’ names and roles in the least 60 calendar days after the report
measure if, even after 60 days, we find was originally sent to the providers and
emcdonald on DSK5VPTVN1PROD with RULES2

community.
it to not be ‘‘more valid, reliable, (vi) A description of the discussion suppliers), regardless of the status of
responsive to consumer preferences, about the proposed alternative measure, any requests for error correction.
cost-effective, or relevant to dimensions including a summary of all pertinent (e) If a provider or supplier has a data
of quality and resource’’ than a standard arguments supporting and opposing the or error correction request outstanding
measure. measure. at the time the reports become public,
(2) An alternative measure approved (vii) Unless CMS has already the qualified entity must, if feasible,
under the process at paragraph (b)(1)(i) approved the same measure for use by post publicly the name of the appealing

VerDate Mar<15>2010 18:13 Dec 06, 2011 Jkt 226001 PO 00000 Frm 00030 Fmt 4701 Sfmt 4700 E:\FR\FM\[Link] 07DER2
 Federal Register / Vol. 76, No. 235 / Wednesday, December 7, 2011 / Rules and Regulations 76571

provider or supplier and the category of (iv) The type(s) of problem(s) leading demonstrate improved performance
the appeal request. to the request for error correction. after the implementation of a CAP.
(v) The amount of time to (4) Improperly uses or discloses
§ 401.719 Monitoring and sanctioning of acknowledge the request for data or
qualified entities. claims information received from CMS
error correction. in violation of the requirements in this
(a) CMS will monitor and assess the (vi) The amount of time to respond to
performance of qualified entities and subpart.
the request for error correction.
their contractors using the following (vii) The number of requests for error (5) Based on its re-application, no
methods: correction resolved. longer meets the requirements in this
(1) Audits. (c) A qualified entity must inform subpart.
(2) Submission of documentation of CMS of inappropriate disclosures or (6) Fails to maintain adequate data
data sources and quantities of data upon uses of beneficiary identifiable data from other sources in accordance with
the request of CMS and/or site visits. under the DUA. § 401.711(c).
(3) Analysis of specific data reported (d) CMS may take the following
to CMS by qualified entities through actions against a qualified entity if CMS (b) Return or destruction of CMS data
annual reports (as described in determines that the qualified entity upon voluntary or involuntary
paragraph (b) of this section) and reports violated any of the requirements of this termination from the qualified entity
on inappropriate disclosures or uses of subpart, regardless of how CMS learns program:
beneficiary identifiable data (as of a violation: (1) If CMS terminates a qualified
described in paragraph (c) of this (1) Provide a warning notice to the entity’s agreement, the qualified entity
section). qualified entity of the specific concern, and its contractors must immediately
(4) Analysis of complaints from which indicates that future deficiencies upon receipt of notification of the
beneficiaries and/or providers or could lead to termination. termination commence returning or
suppliers. (2) Request a corrective action plan destroying any and all CMS data (and
(b) A qualified entity must provide (CAP) from the qualified entity. any derivative files). In no instance can
annual reports to CMS containing (3) Place the qualified entity on a this process exceed 30 days.
information related to the following: special monitoring plan.
(1) General program adherence, (4) Terminate the qualified entity. (2) If a qualified entity voluntarily
including the following information: terminates participation under this
(i) The number of Medicare and § 401.721 Terminating an agreement with a subpart, it and its contractors must
private claims combined. qualified entity. return to CMS, or destroy, any and all
(ii) The percent of the overall market (a) Grounds for terminating a CMS data in its possession within 30
share the number of claims represent in qualified entity agreement. CMS may days of notifying CMS of its intent to
the qualified entity’s geographic area. terminate an agreement with a qualified end its participation.
(iii) The number of measures entity if CMS determines the qualified (Catalog of Federal Domestic Assistance
calculated. entity or its contractor meets any of the Program No. 93.773, Medicare—Hospital
(iv) The number of providers and following: Insurance; and Program No. 93.774,
suppliers profiled by type of provider (1) Engages in one or more serious Medicare—Supplementary Medical
and supplier. violations of the requirements of this Insurance Program)
(v) A measure of public use of the subpart. Dated: November 1, 2011.
reports. (2) Fails to completely and accurately
Donald M. Berwick,
(2) The provider and supplier data report information to CMS or fails to
make appropriate corrections in Administrator, Centers for Medicare &
sharing, error correction, and appeals Medicaid Services.
process, including the following response to confidential reviews by
providers and suppliers in a timely Approved: November 29, 2011.
information:
(i) The number of providers and manner. Kathleen Sebelius,
suppliers requesting claims data. (3) Fails to submit an approvable Secretary, Department of Health and Human
(ii) The number of requests for claims corrective action plan (CAP) as Services.
data fulfilled. prescribed by CMS, fails to implement [FR Doc. 2011–31232 Filed 12–5–11; 11:15 am]
(iii) The number of error corrections. an approved CAP, or fails to BILLING CODE 4120–01–P
emcdonald on DSK5VPTVN1PROD with RULES2

VerDate Mar<15>2010 18:13 Dec 06, 2011 Jkt 226001 PO 00000 Frm 00031 Fmt 4701 Sfmt 9990 E:\FR\FM\[Link] 07DER2