By Jane Thorpe

Background

Health policy experts and lawmakers believe that measuring and publicly reporting information about the performance of physicians, hospitals, and other health care providers is critical to improving health care quality and controlling costs. Advancing health information access and transparency is a goal of the Patient Protection and Affordable Care Act (ACA),^[1] which includes a number of provisions to incentivize quality measurement and reporting and to enable more informed consumer decision-making. Across the country, community organizations, such as the Alliances participating in the Robert Wood Johnson Foundation’s Aligning Forces for Quality initiative, have been demonstrating the power of using private payer and Medicaid medical claims data to measure and publicly report on provider performance. Their work would be further strengthened by access to Medicare claims data because it is the single largest pool of information about how health care is delivered in America. If Medicare data could be combined with data from other public and private payers such as Medicaid and employer sponsored plans, provider performance measurement would be more complete and accurate, and the resulting quality of public reporting would further empower consumer engagement and quality improvement.

Historically, the statutes and regulations governing the Medicare program have barred access to individually identifiable claims data by private community organizations for purposes other than research. Like the data maintained by private insurers and plan administrators, Medicare claims data are used primarily to pay claims. The data therefore include confidential information about patients and physicians and are protected by the privacy and security provisions of various federal laws: the Health Insurance Portability and Accountability Act (HIPAA);^[2] the Privacy Act of 1974;^[3] and the Federal Information Security Management Act (FISMA).^[4] In addition, the federal government’s authority to release Medicare claims data derives from the Social Security Act (SSA) itself, which authorizes release of Medicare data by the U.S. Department of Health and Human Services (HHS) Centers for Medicare and Medicaid Services (CMS) only in certain circumstances: payment of claims;^[5] research and demonstrations;^[6] and for purposes related to contractor performance of agency-specific functions, including entities such as Quality Improvement Organizations (QIOs),^[7] which perform external quality review functions for CMS. Historically, CMS has limited its data release to these specifically authorized activities.

Over the past several years, as data access for performance measurement, public reporting, and consumer engagement has grown as a public policy issue, CMS has developed additional approaches to releasing data for quality improvement purposes. For example, the agency has released Medicare claims data to QIO subcontractors to generate consensus-based physician quality measurements.^[8] Similarly, CMS has used Medicare claims data to generate and publish performance information at the physician practice level.^[9] Finally, in accordance with congressional expectations and authorization regarding greater health information transparency and support for patients and consumers, CMS now releases significant amounts of institutional quality performance information on its Compare websites (e.g., Hospital Compare).^[10] Through these expanded activities, CMS has sought to use data in more innovative ways and to generate cross-payer comparisons of health care services and payment. However, these initiatives still fall short of a general policy allowing access to Medicare data by private and public third-party entities engaged in community-based cross-payer performance measurement. The ACA takes a significant step to address this limitation by significantly expanding HHS’ authority to release Medicare claims data to organizations that meet certain requirements for performance measurement and reporting.

Changes Made by the Affordable Care Act (Pub. L. 111-148 §§, as modified by P.L. 111-152)

Availability of Medicare Data for Performance Measurement (Section 10332)^[11]

• Availability of Medicare Data: The HHS Secretary must release to “qualified entities” “standardized extracts” of Medicare claims data for one or more specified geographic areas and time periods for the sole purpose of measuring and publicly reporting the performance of providers of services and suppliers.^[12]
• “Qualified Entity” Defined: A “qualified entity” (QE) is defined as a public or private entity that “is qualified…to use claims data to evaluate the performance of providers of services and suppliers on measures of quality, efficiency, effectiveness, and resource use” and that agrees to meet applicable legal requirements, including ensuring the security of the data.^[13] In the recently released proposed rule, CMS indicated that it expects most QE applications will come from nonprofit organizations “such as existing community collaboratives.”^[14]
• “Standardized Extracts” of Medicare Claims Data Defined: “Standardized extracts” of Medicare claims data will include data from Parts A and B (including inpatient hospital, outpatient hospital, skilled nursing facility, home health, and hospice services, physician/supplier and DME claims) and Part D (prescription drug) data.^[15]
• Beneficiary Privacy: The HHS Secretary is required to take necessary steps to ensure the identity of individuals enrolled in Medicare is protected.^[16]
• Fee for Data: The Secretary is authorized to charge QEs a fee equal to the cost of making the data available.^[17]
• Specification of Methodologies: QEs may only use “standard measures” endorsed by the National Quality Forum (NQF) or developed under the Public Health Services Act or “alternative measures” approved by the Secretary to evaluate the performance of providers of services and suppliers.^[18]
• Use of Non-Medicare Claims Data: QEs must combine the Medicare claims data with other non-Medicare claims data in measuring the performance of providers of services and suppliers.^[19]
• Reports: As a condition of the receipt of data, QEs must generate reports on the performance of providers of services and suppliers and release the reports publicly. Prior to public release, the QE must allow any provider or supplier included in the report an opportunity to appeal and correct any errors. Performance information about providers and suppliers included in public reports must be in an aggregate form.^[20]

Implementation

Agency

CMS is responsible for issuing regulations and developing and implementing the Medicare QE data release for performance measurement program.

Key Dates

• The ACA states that the Medicare QE data release program shall be effective as of January 1, 2012.^[21]
• CMS issued a notice of proposed rulemaking (NPRM) to implement the Medicare QE data release program on June 8, 2011, with comments due on August 8, 2011.^[22]

Process

Interested QEs will be required to submit applications to CMS. In the NPRM, CMS proposes an annual (rather than rolling) application process with applications posted on the CMS website on January 1, 2012. Applications would be due March 31, 2012 and by close of first quarter each year thereafter. CMS also proposes to approve applicants for three year periods from the date of CMS approval notification. Re-applications for subsequent three year periods would be submitted six months before the end of the three-year period (updates/changes to original application).

Key Issues

• Important, Yet Limited Step: Given CMS’ current limited authority to release Medicare claims data (in short to pay claims, for research and demonstrations, and to contractors to perform agency functions), coupled with the sensitive nature of the data (including beneficiary identifiable information), this is a significant step. However, the actual release of Medicare claims data is constrained by very specific statutory parameters that are mirrored in the proposed implementing regulations. CMS is only authorized to release the data to organizations that 1) meet very prescriptive requirements, including ensuring the privacy and security of the data, previous experience using claims data, and access to non-Medicare claims data; 2) agree to only use certain approved performance measures; and 3) agree only to release performance reports approved by CMS. That being said, this program will be of great interest to multi-stakeholder community organizations such as the Robert Wood Johnson Foundation Aligning Forces for Quality Alliances that are working to produce and report provider performance information in their communities.
• Any Willing Qualified Entity: CMS proposes to set standards for certifying QEs and will release Medicare claims data to all QEs that meet the required standards. In the NPRM, The agency does not propose to create exclusive franchises, but rather permit competing QEs in the same geographic area. CMS recognizes that this may result in providers and suppliers getting performance reports from multiple QEs and is seeking comment on whether it should cap the number of QEs in a given area or other mechanisms of addressing the multiple report issue.
• Cost of the Data: It is unclear whether organizations that otherwise meet the statutory and proposed regulatory standards will be able to afford the cost of the data. CMS estimates that the approximate cost to provide a QE with three years of data covering five million beneficiaries would be $275,000 ($150,000 for the data and $125,000 for the program costs).^[23]
• Annual Reports: In the NPRM, CMS proposes to require QEs to produce provider AND supplier performance reports at least annually. CMS also proposes to bar QEs from using a report that has not been approved by CMS, even if CMS’ review takes longer than 90 days. It is unclear whether QEs will be able to produce comprehensive and actionable reports, including allowing providers and suppliers adequate time to review (and possibly appeal), on an annual basis at the outset. CMS might consider a phased in approach that would allow organizations additional time to work with the Medicare claims data as well providers and suppliers in their area initially and then move to requiring annual reports in years two or three and beyond.
• National vs. Regional Approach: Rather than providing a nationwide extract, CMS is proposing to limit the availability of Medicare data to the geographic spread of the QE’s other claims data (e.g., state of Maryland). However, this will not allow a national view provider and supplier performance across the country or intra-state comparisons. If organizations have access to nationwide extracts of non-Medicare claims data, CMS could consider providing nationwide extracts to support national comparisons.
• Exclusion of FQHC and RHC Data: The NPRM provides that standardized data extracts will include information on final, adjudicated claims (as opposed to those that are only pending) from all seven claim types that are submitted for payment in the Medicare Fee-For-Service (FFS) Program (inpatient hospital, outpatient hospital, skilled nursing facility, home health, and hospice services, physician/supplier and DME) and Part D “drug event” information. Federally Qualified Health Center (FQHC) and Rural Health Clinic (RHC) data will not be included in the extracts as they do not bill Medicare on a FFS basis. This is an unfortunate omission, particularly for underserved communities that are no exception to the lack of availability of comprehensive provider performance information.
• Measuring Resource Use and Cost: Since the development of resource use and cost measures is still in its infancy (compared to the wealth of approved quality performance measures), it will be critical for CMS to approve the use of “alternate measures” to support the development and use of resources use and/or cost measures. This information will enable QEs to prepare performance reports that reflect not just the quality of care, but also the cost of care and ultimately the value (quality and cost) of the care.
• Privacy and Security of Data: CMS proposes not to provide individual beneficiary names in the standardized extracts of Medicare claims data. Rather, CMS proposes to include an encrypted beneficiary identifier that would permit linking of claims for the same beneficiary across multiple files and multiple years without identifying individual beneficiaries. In addition, CMS proposes to require QEs to execute a data use agreement (DUA) with CMS (the type of agreement that is required for CMS-supported research) that will stipulate privacy and security protections for the data.^[24] The DUA will contain significant penalties for inappropriate disclosures of the data, including both civil monetary penalties and criminal penalties. Despite these protections, providers and beneficiaries are likely to express concern that these steps are insufficient to protect the data released both to the QEs as well as to the providers and suppliers for their review of the performance reports.

Recent Agency Action

• As noted above, CMS issued a proposed regulation to implement Section 10332 on June 8, 2011.

Authorized Funding Levels

• There is no authorized funding for this program. Rather, HHS is authorized to charge a fee for the cost of making the data available.