[Federal Register: May 28, 2008 (Volume 73, Number 103)]
[Rules and Regulations]
[Page 30663-30685]
From the Federal Register Online via GPO Access [wais.access.gpo.gov]
[DOCID:fr28my08-17]
[[Page 30663]]
-----------------------------------------------------------------------
Part II
Department of Health and Human Services
-----------------------------------------------------------------------
Centers for Medicare & Medicaid Services
-----------------------------------------------------------------------
42 CFR Part 423
Medicare Program; Medicare Part D Claims Data; Final Rule
[[Page 30664]]
-----------------------------------------------------------------------
DEPARTMENT OF HEALTH AND HUMAN SERVICES
Centers for Medicare & Medicaid Services
42 CFR Part 423
[CMS-4119-F]
RIN 0938-AO58
Medicare Program; Medicare Part D Claims Data
AGENCY: Centers for Medicare & Medicaid Services (CMS), HHS.
ACTION: Final rule.
-----------------------------------------------------------------------
SUMMARY: This final rule allows the Secretary to collect claims data
that are presently being collected for Part D payment purposes for
other research, analysis, reporting, and public health functions. The
Secretary needs to use these data because other publicly available data
are not, in and of themselves, sufficient for the studies and
operations that the Secretary needs to undertake as part of the
Department of Health and Human Service's obligation to oversee the
Medicare program, protect the public's health, and respond to
Congressional mandates. These data will also be used to better
identify, evaluate and measure the effects of the Medicare
Modernization Act of 2003, (MMA).
DATES: Effective Date: This regulation is effective June 27, 2008. Date
of Applicability: This regulation applies to Part D claims data
collected on or after January 1, 2006. Following the effective date of
this final rule, we will recollect under section 1860D-12(b)(3)(D) of
the Act any data that were first submitted prior to the effective date
of this final rule by extracting them from the Part D claims data
already collected for payment purposes.
FOR FURTHER INFORMATION CONTACT: Alissa DeBoy, (410) 786-6041; Nancy
DeLew, (202) 690-7351.
SUPPLEMENTARY INFORMATION: Copies: To order copies of the Federal
Register containing this document, send your request to: New Orders,
Superintendent of Documents, P.O. Box 371954, Pittsburgh, PA 15250-
7954. Specify the date of the issue requested and enclose a check or
money order payable to the Superintendent of Documents, or enclose your
Visa or Master Card number and expiration date. Credit card orders can
also be placed by calling the order desk at (202) 512-1800 (or toll
free at 1-888-293-6498) or by faxing to (202) 512-2250. The cost for
each copy is $10. As an alternative, you can view and photocopy the
Federal Register document at most libraries designated as Federal
Depository Libraries and at many other public and academic libraries
throughout the country that receive the Federal Register. This Federal
Register document is also available from the Federal Register online
database through GPO Access, a service of the U.S. Government Printing
Office. The Web site address is: http:// www.access.gpo.gov/fr/
index.html.
I. Background
A. Requirements for Issuance of Regulations
Section 902 of the Medicare Prescription Drug, Improvement, and
Modernization Act of 2003 (MMA) (Pub. L. 108-173) amended section
1871(a)(3) of the Social Security Act (the Act) and requires the
Secretary, in consultation with the Director of the Office of
Management and Budget (OMB), to establish and publish timelines for the
publication of Medicare final regulations based on the previous
publication of a Medicare proposed or interim final regulation. Section
1871(a)(3)(B) of the Act also states that the timelines for these
regulations may vary, but shall not exceed 3 years after publication of
the preceding proposed or interim final regulation, except under
exceptional circumstances. This final rule finalizes provisions set
forth in our October 18, 2006 proposed rule. In addition, this final
rule is being published within the 3-year time limit imposed by section
1871(a)(3)(B) of the Act. Therefore, we believe that the final rule is
in accordance with the Congress's intent to ensure timely publication
of final regulations.
B. General Overview
As stated in the October 18, 2006 proposed rule, under the Act, the
Secretary has the authority to include in Part D sponsor contracts any
terms or conditions the Secretary deems necessary and appropriate,
including requiring the organization to provide the Secretary with such
information as the Secretary may find necessary and appropriate. (See
section 1857(e)(1) of the Act as incorporated into Part D through
section 1860D-12(b)(3)(D) of the Act.)
We proposed to implement section 1860D-12(b)(3)(D) of the Act to
allow the Secretary to collect the same claims information now
collected under the authority of section 1860D-15 of the Act for
purposes including reporting to the Congress and the public, conducting
evaluations of the overall Medicare program, making legislative
proposals to Congress, and conducting demonstration projects. While the
purposes underlying such collection are discussed in more detail in
this final rule, they include, but are not limited to, evaluating the
effectiveness of the new prescription drug benefit and its impact on
health outcomes, performing Congressionally mandated or other
demonstration and pilot projects and studies, reporting to Congress and
the public regarding expenditures and other statistics involving the
new Medicare prescription drug benefit, studying and reporting on the
Medicare program as a whole, and creating a research resource for the
evaluation of utilization and outcomes associated with the use of
prescription drugs.
We note that because this final rule applies to all Part D
sponsors, it applies to any entity offering a Part D plan, including
both prescription drug plan sponsors and Medicare Advantage
organizations offering qualified prescription drug coverage. We further
note that the Part D prescription drug event data (hereinafter also
referred to as ``Part D claims data'') collected in accordance with
section 1860D-12(b)(3)(D) of the Act will include 37 drug claim
elements submitted by drug plan sponsors to the Secretary, which in
accordance with Sec. 423.100, include not only data from claims for
drugs, but also data from claims for insulin, biological products,
certain medical supplies, and vaccines.
II. Provisions of the Proposed Rule With an Analysis of and Response to
Public Comments
We received approximately 118 items of timely correspondence
containing comments on the October 18, 2006 proposed rule. Commenters
included health policy organizations, pharmacies and pharmacy-related
organizations, members of the Congress, researchers, insurance industry
representatives, physicians and other health care professionals,
beneficiary advocacy groups, representatives of hospitals, Part D
beneficiaries, a pharmacy benefit managers' trade association and
others.
In this final rule, we address all comments and concerns on the
policies included in the proposed rule. The following lists the
provisions of the proposed rule that received the most comments:
External access to the data
Uses for the data
Privacy protections for the data
Generally, the vast majority of commenters expressed strong support
for the proposed rule, declaring it essential for the success and
accurate evaluation of the Medicare Part D program. There was also a
significant
[[Page 30665]]
amount of agreement among the commenters that external entities be
allowed access to Part D claims data. Commenters pointed out that CMS
could not possibly fund all the research needed, and because of that,
allowing external entities access to these data is necessary in order
to evaluate the many health care issues arising from the new
prescription drug benefit. Commenters also noted that research by
external entities is likely to result in lower government expenditures
and better delivery of health care to beneficiaries. Many of the
commenters supporting the rule cited multiple examples of the potential
benefits to the public health that could result with the access to Part
D claims data by qualified organizations and individuals, including
assessing the impact prescription drugs have on the health outcomes of
the elderly, cost efficiencies, quality of care measures, and the
efficacy of prescription drugs.
A number of comments addressed privacy protections, which impact
the collection and release of claims data, and other commenters
expressed concern about sensitive financial information being released.
The majority of commenters acknowledged that a risk to protected
information exists; however, they believed that the risk is no greater
than the risk involved when allowing access to currently available
Medicare data.
Several commenters raised concerns about the inherent limitations
associated with the use of claims data for research purposes and
requested that we acknowledge these limitations. In the following
sections, we address all of these comments.
A. General Provisions
1. Statutory Basis
On December 8, 2003, the Congress enacted the Medicare Prescription
Drug, Improvement, and Modernization Act of 2003 (MMA) (Pub. L. 108-
173). Title I of the MMA amended the Act to establish a new voluntary
prescription drug benefit program, Medicare Part D. As we stated in the
preamble to the January 28, 2005 final rule (70 FR 4197) implementing
the new prescription drug benefit, we believe that the addition of
outpatient prescription drug coverage to the Medicare program is the
most significant change to the Medicare program since its inception in
1965.
Unlike Parts A and B of the Medicare program, where Medicare acts
as the payer and insurer and generally pays for items and services on a
fee-for-service basis, the prescription drug benefit is based on a
private market model. Under this model, CMS contracts with private
entities--prescription drug plan (PDP) sponsors, Medicare Advantage
(MA) organizations, as well as other types of Medicare health
organizations--who then act as the payers and insurers for prescription
drug benefits. These private entities are generally referred to as
``Part D sponsors'' in our rules. Section 1860D-12 of the Act contains
the majority of provisions governing the contracts CMS enters into with
the Part D sponsors. That section, entitled, ``Requirements for and
contracts with prescription drug plan (PDP) sponsors,'' incorporates by
reference many of the contract requirements that previously were
applicable to Medicare Advantage organizations.
One of the incorporated provisions at section 1860D-12(b)(3)(D) of
the Act, is section 1857(e)(1) of the Act, which provides broad
authority for the Secretary to add terms to the contracts with Part D
sponsors, including terms that require the sponsor to provide the
Secretary ``with such information * * * as the Secretary may find
necessary and appropriate.'' We believe that the broad authority of
section 1860D-12(b)(3)(D) of the Act authorizes us to collect most of
the information we currently collect to properly pay sponsors under the
statute. However, section 1860D-15 of the Act contains provisions that
might be viewed as limiting such collection. Therefore, we engaged in
this rulemaking in order to resolve the statutory ambiguity, as well as
to implement the broad authority of section 1860D-12(b)(3)(D) of the
Act.
Most of the payment provisions with respect to Part D sponsors are
found in section 1860D-15 of the Act.\1\ Subsections (d) and (f) of
section 1860D-15 of the Act authorize the Secretary to collect any
information he needs to carry out that section. However, those
subsections also state that ``information disclosed or obtained under
[section 1860D-15 of the Act] may be used by officers, employees, and
contractors of the Department of Health and Human Services only for the
purposes of, and to the extent necessary in, carrying out [section
1860D-15 of the Act].'' (Sections 1860D-15(d)(2)(B) and (f)(2) of the
Act).
---------------------------------------------------------------------------
\1\ We note that there are other provisions outside of section
1860D-15 of the Act that also contain payment provisions. For
example, section 1860D-14 of the Act discusses how CMS pays the low-
income subsidy.
---------------------------------------------------------------------------
In the January 28, 2005 Medicare prescription drug benefit final
rule (70 FR 4399), we stated that the section 1860D-15 of the Act
restriction applies only in cases where section 1860D-15 of the Act is
the authority for collecting the information. When information is
collected under an independent authority (even if the collected
information duplicates the data collected under section 1860D-15 of the
Act) the restrictions under 1860D-15 of the Act would not apply. In the
January 28, 2005 final rule (70 FR 4399), we noted that because quality
improvement organizations (QIOs) have independent authority to collect
Part D claims data in order to evaluate the quality of services
provided by Part D sponsors, QIOs would not be barred from collecting
such data despite the restrictions of section 1860D-15 of the Act. We
refer readers to the October 18, 2006 proposed rule for the exact
citation to the discussion in the January 28, 2005 final rule (71 FR
61447). Similar to the statutory provisions authorizing QIOs to collect
the information they need to perform their statutory duties, section
1860D-12(b)(3)(D) of the Act recognizes that the Secretary will need to
collect a broad array of data in order to properly carry out his
responsibilities as head of the Department of Health and Human Services
(DHHS). Thus, if the Secretary determines it is necessary and
appropriate under section 1860D-12 of the Act for him to collect Part D
claims data in order to carry out responsibilities outside section
1860D-15 of the Act, then section 1860D-15 of the Act would not serve
as an impediment to such collections.
As stated in the October 18, 2006 proposed rule, we also believe
that language in sections 1860D-12(b)(3)(D) and 1857(e)(1) of the Act
indicating that the authority to collect information exists only
``except as otherwise provided,'' and in a manner that is ``not
inconsistent with this Part,'' would not serve as a hindrance to the
independent collection of Part D claims data, since on its face,
section 1860D-15 of the Act restricts use of information only when
collected under that authority.
As we stated in the proposed rule, the Congress most likely
included the broad grant of authority in section 1860D-15 of the Act in
order to ensure that the Secretary, without engaging in any rulemaking,
would have the legislative authority to collect any necessary data in
order to pay Part D sponsors correctly. However, we do not believe that
the Congress intended to restrict the Secretary when the Secretary
otherwise has independent authority to collect identical information to
that collected under section 1860D-15 of the Act. Rather, we noted that
the Secretary will need to evaluate Part D claims information in order
to determine how access to Part D drug benefits affects beneficiary
utilization of services under Parts A and B of the Medicare program.
[[Page 30666]]
Specifically, when Congress enacted the MMA, one of the stated reasons
was to ensure that ``by lowering the cost of critical prescription
drugs, seniors will better be able to manage their health care, and
ultimately live longer, healthier lives.'' (Press Release, House Ways
and Means Committee, Seniors Wait for Affordable Rx Drugs Comes to an
End. President Bush Signs Historic Medicare Bill into Law (December 8,
2003) (available at http://waysandmeans.house.gov/news.asp )). In order
to determine whether lowering the costs of prescription drugs actually
reduces health expenditures or improves health outcomes for
beneficiaries, the Secretary will need to match individual level Parts
A and B data with Part D claims data. In this way, the Secretary will
be able to evaluate the effectiveness and efficiency of the Part D
benefit and report to the Congress and others on the progress of the
program.
We are required to report to the Congress regarding whether
mandated disease management demonstrations are budget neutral and
whether beneficiaries in these demonstrations are on the appropriate
medications. As we stated in the preamble of the proposed rule we may
also need to make reports under the Part D program, for example, the
publication of statistics detailing aggregate Medicare and beneficiary
spending by class of drug, average number of drugs used by
beneficiaries, total Medicare program spending, and other similar
statistics. In order to derive such statistics, we would need to use
Part D claims data. In the proposed rule, as well as in this final
rule, we outlined a wide variety of situations in which it will be
``necessary and appropriate'' for CMS to evaluate the same information
collected under section 1860D-15 of the Act, even though such
information would not be used to implement section 1860D-15 of the Act.
In these situations, we believe the clear language of section 1860D-
12(b)(3)(D) of the Act provides the authority to collect the necessary
information, and nothing about such collection will be inconsistent or
in conflict with any other part of the statute.
In addition, as discussed in this preamble, we are adding section
1106 of the Act as a statutory basis for this final rule, as that
section authorizes release of data by the agency through regulation.
Comment: Some commenters stated that the proposed rule was
inconsistent with the statute. Commenters also asserted that the
collection is neither necessary nor appropriate, and some contended
that the rule would improperly allow the release of proprietary data.
Response: We refer readers to our discussion of the statutory basis
in both the proposed rule (71 FR 61446) and in section II.A.1. of this
final rule. As noted in the proposed rule, section 1860D-12(b)(3)(D) of
the Act (and its incorporation of section 1857(e)(1)) of the Act
provide broad authority to the Secretary to require Part D sponsors to
provide the Secretary with ``such information as the Secretary may find
necessary and appropriate.'' In addition, sections 1860D-15(d)(2)(B)
and (f)(2) of the Act, by their own terms, restrict information only
when ``disclosed or obtained under the provisions of [section 1860D-15
of the Act].'' Thus, we continue to believe that when information is
collected through a statutory authority independent of section 1860D-15
(such as in the case of QIOs, who have independent authority to collect
data) the restrictions of section 1860D-15 of the Act would not apply,
and nothing about the collection or use of the claims data would create
an inconsistency or conflict in the statute.
We also believe the collection of claims data under section 1860D-
12 of the Act is both necessary and appropriate for the reasons
discussed in the proposed rule and in this final rule. For example, the
collection of such claims data will permit the Secretary to conduct
high level, internal analyses of the Part D benefit, such as which
drugs are commonly used by the Medicare population, the utilization of
generic drugs in the Part D benefit, the effect of benefit design on
catastrophic costs (costs for which reinsurance is available), the
number of individuals who entered the catastrophic phase of the
benefit, and many more types of analysis. Similarly, the Secretary will
have the opportunity to crosswalk Part D claims data to Parts A and B
data in order to analyze the effect of access to prescription drugs on
utilization under hospital and supplementary medical insurance.
We know that one of the stated reasons for the drug benefit was to
modernize Medicare and ensure that beneficiaries were not enduring
unnecessary hospitalizations due to failure to access preventive
prescription drug regimens. At the time the prescription drug benefit
was being enacted into law, then-chairman of the Senate Finance
Committee, Senator Charles Grassley, stated:
[T]his bill is about enhancing quality of life * * *. Today, the
practice of medicine--and a lot of the thanks can go to prescription
drugs--is to keep people out of hospitals and out of operating
rooms. So people who cannot afford drugs, who go to the doctor very
sick, are going to not only end up in a place they do not want to
go, because people would rather not go to hospitals, rather not go
to operating rooms. It is going to save our programs a lot of money,
both private and public payment programs, for doctors and hospitals,
when we can have people go into programs where they can get
prescription drugs and keep their health up so they do not go to the
hospital.
(Medicare Prescription Drug, Improvement, and Modernization Act
of 2003--Conference Report, 149 Cong. Rec. S15882-03, *S15883 and
S15884 (November, 25, 2003)).
Access to Parts A, B, and D claims data will allow the Secretary to
analyze the prescription drug utilization of chronically ill patients
over time, and determine whether increases in prescription drug
utilization do, in fact, result in fewer hospitalizations. This is the
type of analysis we believe the Congress expected the Secretary to
engage in, and such analysis is both necessary and appropriate under
the law.
Finally, in response to concerns about releasing proprietary data
to external entities as a result of this rulemaking, we note that data
which could affect Medicare program spending, such as rebates, bids,
reinsurance, and risk-sharing data, are not part of this rulemaking. In
addition, as discussed later in this preamble, this rulemaking places
certain limitations on data when released outside of CMS. We believe
that it is in the interest of public health to share information
collected under the regulations promulgated by this rule with entities
outside of CMS for legitimate research, or in cases of other
governmental agencies, for purposes consistent with their mission.
Through the application of our ``minimum data necessary policy'', with
some additional restrictions to protect beneficiary confidentiality and
commercially sensitive data of Part D sponsors, and our data sharing
procedures (which ensure the agency's compliance with the Health
Insurance Portability and Accountability Act of 1996 (HIPAA), the
Privacy Act of 1974, and other applicable laws), we will limit the use
and disclosure of Part D claims data to ensure that the data are only
used or disclosed as permitted or required by applicable law, and not
inappropriately disclosed in a manner which could undermine the
competitive nature of the Part D program.
Comment: One commenter requested that CMS postpone implementation
of this regulation until the Congress clarifies CMS's statutory
authority and that CMS answer certain questions in a second posting for
comment.
[[Page 30667]]
Response: We believe we have the authority to collect Part D claims
data under sections 1860D-12 and 1860D-15 of the Act, and to disclose
Part D claims data collected under section 1860D-12 of the Act, in
accordance with section 1106 of the Act. This final rule is
sufficiently related to the proposals in the proposed rule, which were
the subject of vigorous review and comment by the public, and we are
not posting the proposal for a second round of comments.
Comment: One commenter questioned why we were equating collecting
data with accessing data.
Response: As stated in both the proposed rule and this final rule,
in order to ensure that Part D sponsors are not required to submit a
second set of the same data already collected under section 1860D-15,
we would collect the data that are the subject of this final rule by
extracting them from Part D claims data already collected for payment
purposes. This is the same approach we used when we discussed QIO
access to data in the January 28, 2005 Part D final rule (70 FR 4399),
where we stated that ``to the extent QIOs need access to data from the
transactions between pharmacies and Part D sponsors, these data could
be extracted from the claims data submitted to us''. Thus, in the
preamble to this final rule, as in the preamble to the proposed rule
(71 FR 61447), we may refer to ``accessing'' rather than ``collecting''
Part D data.
2. Information To Be Collected
In the proposed rule, we proposed to independently collect the same
claims information collected under section 1860D-15 of the Act under
the authority of section 1860D-12(b)(3)(D) of the Act. The Part D
claims data for 2006 and 2007 includes 37 data elements. We referred
readers to the Prescription Drug Event data instructions which can be
accessed at http://www.cms.hhs.gov/DrugCoverageClaimsData/01_
PDEGuidance.asp#TopOfPage for a full description of this information.
These instructions define each data element and its specific
potential use for CMS's payment process. Generally stated, these data
elements include the following:
Identification of the Part D sponsor and Part D plan
through contract number and plan benefit package identification number.
Health insurance claim number, which identifies the
particular beneficiary receiving the prescription.
Patient date of birth and gender.
Date of service.
Date paid by the plan.
Identification of pharmacy where the prescription was
filled.
Identification of prescribing health care professional.
Identification of dispensed product using national drug
code (NDC) number.
Indication of whether drug was compounded or mixed.
Indication of prescriber's instruction regarding
substitution of generic equivalents or order to ``dispense as
written.''
Quantity dispensed (for example, number of tablets, grams,
milliliters, or other unit).
Days supply.
Fill number.
Dispensing status and whether the full quantity is
dispensed at one time, or the quantity is partially filled.
Identification of coverage status, such as whether the
product dispensed is covered under the plan benefit package or under
Part D or both. This code also identifies whether the drug is being
covered as part of a Part D supplemental benefit.
Indication of whether unique pricing rules apply, for
example because of an out-of-network or Medicare as Secondary Payer
services.
Indication of whether beneficiary has reached the annual
out-of-pocket threshold, which triggers reduced beneficiary cost-
sharing and reinsurance subsidy.
Ingredient cost of the product dispensed.
Dispensing fee paid to pharmacy.
Sales tax.
For covered Part D drugs, the amount of gross drug costs
that are both below and above the annual out-of-pocket threshold.
Amount paid by patient and not reimbursed by a third party
(such as copayments, coinsurance, or deductibles).
Amount of third party payment that would count toward a
beneficiary's true out-of-pocket (TrOOP) costs in meeting the annual
out-of-pocket threshold, such as payments on behalf of a beneficiary by
a qualifying State Pharmaceutical Assistance Program (SPAP).
Low income cost sharing subsidy amount (if any).
Reduction in patient liability due to non-TrOOP-eligible
payers paying on behalf of the beneficiary. This would exclude payers
whose payments count toward a beneficiary's true out of pocket costs,
such as SPAPs.
Amounts paid by the plan for basic prescription drug
coverage and amounts paid by plan for benefits beyond basic
prescription drug coverage.
In 2008, the number of elements collected in the Part D claims data
was expanded from 37 to 39. Specifically, we added additional elements
to reflect the estimated rebate amount applied to the point-of-sale
price and the vaccine administration fee. Because these elements were
added for 2008, they were not addressed in the October 18, 2006
proposed rule. Furthermore, in the October 2006 proposed rule (71 FR
61447), we did not explicitly discuss how we would respond to future
changes in the elements collected as part of the claim. Rather, the
proposed rule included only a discussion of the 37 elements that then
comprised the Part D claim and proposed that we would collect these 37
elements under section 1860D-12(b)(3)(D) of the Act. As a result,
interested parties had an opportunity to comment only upon our proposal
to collect the original 37 elements of the Part D claim under section
1860D-12(b)(3)(D) of the Act, and there has not been any similar
opportunity for interested parties to submit comments on whether the
two new elements should also be collected under section 1860D-
12(b)(3)(D) of the Act, such that they may also be used for non-
payment-related purposes. Accordingly, we will not be collecting these
two data elements under section 1860-12(b)(3)(D) of the Act at this
time. We are finalizing a regulation establishing our authority to
collect under section 1860D-12(b)(3)(D) of the Act only those 37 data
elements that were part of the prescription drug event (PDE) record in
2006. Data regarding these 37 elements may be used for both payment-
related and nonpayment-related purposes. As discussed later in this
preamble, such use will be subject to our minimum necessary data
policy, our data sharing procedures, and the encryption of certain
identifiers and aggregation of cost data to protect beneficiary
confidentiality and commercially sensitive data of Part D sponsors.
Because data regarding the 38th and 39th elements will continue to be
collected only under section 1860D-15(d)(2) and (f)(1) of the Act,
consistent with Sec. 423.322(b), these data may be used only for
payment-related purposes.
We note that this final rule does not extend to rebate or other
price concession data, otherwise known as ``direct or indirect
remuneration'' or ``DIR'', with the exception of DIR that may be
reflected in the negotiated price paid for a drug at the point of sale.
Again, the collection of Part D data under the authority of section
1860D-12 of the Act in accordance with this final rule, is limited to
the original 37 data elements collected as part of the Part D claims
data. We have clarified this in
[[Page 30668]]
response to comments and in the regulatory text.
Comment: Commenters were generally supportive of CMS's proposal to
access Part D claims data for research and non-research purposes, and
agreed that the data will provide valuable information and be essential
in the evaluation of the Part D benefit. Several commenters requested
additional elements be added to the original 37 PDE elements outlined
in the proposed rule.
Response: We agree that the PDE data elements we now collect will
provide a valuable tool for evaluating the Part D program, and
appreciate the suggestions to add other elements for collection. This
final rule is first and foremost a clarification of the statutory
authority that allows us to collect the original 37 PDE elements
outlined in the proposed rule and this final rule and to access them
for purposes other than payment. Since these data are already being
collected under the Part D program, we would access the already-
collected data and make them available for research and non-research
purposes, without undue burden to Part D sponsors or beneficiaries.
As discussed above, in 2008, the number of PDE data elements was
expanded to 39. In future years, we may revise our guidance on PDE
Reporting to include additional elements on the claim beyond the
elements presently collected. Through separate rulemaking, we will
address whether we intend to collect any of these additional elements
under our authority in section 1860D-12(b)(3)(D) of the Act.
Comment: Several commenters noted that the proposed rule relates to
drug claims and related information and asked for clarification as to
what is meant by this phrase. A few commenters noted that the presence
of this phrase in the proposed regulatory text suggests that CMS may be
contemplating using and sharing rebate and other discount and pricing
concession data.
Response: Rebate and other price concession data are not the
subject of this final rule. This rulemaking applies to Part D claims
data only, and is limited to the original 37 elements reported on the
PDE. To further clarify this point we are amending proposed Sec.
423.505(f)(3) to delete the applicable reference to ``related
information.''
Comment: Several commenters expressed concern about access to cost
and pricing data. Several commenters noted that pricing data contained
on the Part D claim are not an accurate reflection of the actual costs
to plans. These commenters also requested clarification that the
information we are proposing to collect and disclose relate only to
Part D claims data, and not to competitively sensitive financial data
regarding rebates, discounts or other negotiated price concessions. The
commenters expressed a concern that release of competitively sensitive
data could undermine the competitive bid process. They assert that
plans will be able to adjust their bids on the basis of knowledge of
each others' data, resulting in higher drug costs for all.
Response: We share the commenters concerns about the need to
protect the sensitive data under the Part D program. Because the
Medicare drug benefit is based on a competitive business model, to
release commercially or financially sensitive data to the public could
negatively impact Part D sponsors' ability to negotiate for better
prices, and ultimately affect the ability of sponsors to hold down
prices for beneficiaries and taxpayers. Therefore, we have adopted a
number of protections to mitigate these concerns.
First, we have clarified that this final rule applies only to the
37 original elements of Part D claims data and not to rebate and other
price concessions data. As discussed above, to the extent that the PDE
record was amended in 2008 to include data on estimated rebates applied
at the point of sale, we have clarified it in the regulation that we
will not be collecting this information under that authority. In
addition, we note that plan-specific bid information is not included on
the claim, and therefore, would not be the subject of this rulemaking.
Second, with respect to our disclosures of information collected
under this rulemaking to external entities, we have developed an
approach to minimize the risk of unauthorized disclosure of beneficiary
identifiable information, as well as the use of commercially sensitive
data of Part D sponsors. Similar to the process used under Parts A and
B program:
We will require research using beneficiary identifiable
data to be conducted by an experienced entity at a reputable
organization, with an appropriate research design, and with assurances
to protect beneficiary confidentiality. Research is to be made
available to the public and identifiable data is not released for
commercial purposes.
We will only release beneficiary identifiable data for
research purposes if the CMS privacy board approves the data release
and then, will only release the minimum data necessary for the study.
Requesters who receive identifiers to link to another
dataset will be required to re-encrypt beneficiary identifiers, after
data linkage, to minimize the risk of accidental disclosure.
Requesters will sign a data use agreement which carries
penalties for misuse or intentional release of beneficiary identifiable
information.
In addition to these protections of beneficiary identifiable
information, we plan to impose additional restrictions to further
protect beneficiary confidentiality and plan commercially sensitive
information. When releasing data to external entities, we will restrict
releases according to the following principles:
Only the minimum necessary elements from the PDE will be
released for a project. In accordance with this principle, cost data
will not be released unless necessary for the project.
Drug cost elements (that is, ingredient cost, dispensing
fee, and sales tax) will be aggregated.
Beneficiary identifiers, pharmacy identifiers and
prescriber identifiers will be encrypted where not needed to link to
other datasets. Additionally, an element representing the internal
prescription service reference number assigned by pharmacies will not
be released so as to not indirectly reveal pharmacy identifiers.
Plan identifiers will always be encrypted for external
entities. We note that the internal plan identification numbers on the
claim would also not be available to external entities as these
represent reference numbers assigned by the plan at the time a drug is
dispensed and release of such numbers could lead to a de facto
identification of the plan. We also note that when we state in this
preamble that an identifier will be encrypted, this means that it will
be replaced with a non-identifiable number or code such that there is a
low probability of assigning any meaning to the replacement number or
code. Unless otherwise noted, encryption will occur without any
decryption, and we would not provide a key that allows for an encrypted
identifier to be converted back into its original form. We believe
these restrictions will protect both the commercially sensitive data of
Part D plans, such as the plan identifiers, pharmacy identifiers,
prescriber identifiers and cost elements, as well as the beneficiary
identifiable data included on the claim. Similar protections for both
beneficiary identifiable information as well as commercially sensitive
data of Part D sponsors will be in place for releases to governmental
entities as well including
[[Page 30669]]
States, Congress and other executive branch agencies. For both States
and non-HHS executive branch agencies, the drug cost elements on the
claim (ingredient cost, dispensing fee, and sales tax) will be
aggregated together, and will not be available in a disaggregated
format, except that, upon request, CMS will exclude sales tax from the
aggregation at the individual claim level if necessary for the project.
We believe this aggregation will serve to ensure that some of the most
confidential data on the claim--the separate costs paid by Part D
sponsors for ingredient cost or dispensing fee--will not be vulnerable
to any unauthorized release. However, because these government agencies
may need other data on the claim in order to coordinate treatment of
beneficiaries or further study care received by individual
beneficiaries, we will make the beneficiary, plan, pharmacy, and
prescriber identifiers available to these entities where needed. For
example, as discussed later in this preamble, States have specifically
requested claims data for beneficiaries dually eligible for Medicaid
and Medicare. By understanding the care received by these
beneficiaries, the State Medicaid agencies may be able to better
coordinate the medical costs they reimburse under Medicaid with the
drug regimens being reimbursed under the Medicare Part D program. In
coordinating care, these State agencies may need to understand which
plan a beneficiary is enrolled in. Releases to Congressional oversight
agencies are discussed in response to comment later in this preamble.
We have included these restrictions in our amended regulations at Sec.
423.505(m).
The appendix to this rule also contains a CMS chart, explaining in
more specific detail the restrictions relative to the available PDE
elements for various parties. We will evaluate all requests for these
data to ensure that any release is consistent with the restrictions
contained in our regulations, and we will release only the minimum data
that are necessary for the specific project. Additionally, as part of
our data sharing procedures, we will ensure that any disclosure is for
an appropriate purpose and does not undermine the competitive nature of
the Part D program, such as a disclosure that would result in Part D
sponsors being able to adjust their plan bids on the basis of knowledge
of each others' data.
Finally, while we agree with commenters that cost data on the Part
D claim may not reflect the actual costs to plans, such data does
reflect costs incurred at point-of-sale, and may be of use to CMS,
other governmental entities, and other external entities for projects
unrelated to a plan's total costs.
Comment: One commenter asked that CMS appropriately use and
differentiate between the terms ``sex'' and ``gender'' in its data
collection process.
Response: The Patient Gender Code field in the Part D claim is
defined by the National Council of Prescription Drug Programs (NCPDP).
We have found it helpful in working with the industry and other
stakeholders to rely on the NCPDP industry standard whenever possible.
The NCPDP data dictionary defines ``Gender Code'' under definition of
field, ``For eligibility, and identifying the gender of the member.''
Values are: M=Male, F=Female, and U=Unknown.
B. Purpose of CMS Collecting Information
In the proposed rule, we outlined our intended use of Part D claims
data for a wide variety of statutory and other purposes including--
Reporting to the Congress and the public on the overall
statistics associated with the operation of the Medicare prescription
drug benefit;
Conducting evaluations of the Medicare program;
Making legislative proposals with respect to the programs
we administer, including the Medicare, Medicaid, and the State
Children's Health Insurance Program; and
Conducting demonstration projects and making
recommendations for improving the economy, efficiency, or effectiveness
of the Medicare program.
In the final rule, we continue to believe such uses are necessary
and appropriate. In addition, as discussed below and later in this
preamble, we also intend to use these data for ``other studies
addressing public health questions,'' ``pilot projects,'' ``supporting
quality improvement and performance measurement activities,'' and
``populating personal health records,'' and have added these purposes
to the list in Sec. 423.505(f)(3).
Comment: Many commenters believe analyses of Part D claims data are
necessary for CMS to administer the Medicare program, and for planning,
evaluation, and policy development. Examples of program research and
evaluation uses suggested by commenters include--
Assuring that Part D has not promoted adverse selection
into certain health plans with less generous medication coverage;
Examining the effects of drug coverage and cost
containment on Medicare spending and the health of vulnerable elderly
and disabled persons;
Measuring the success of prescription drug plans in
encouraging the use of generic medicines;
Examining the transition effects of moving dual eligibles
from Medicaid programs to Part D;
Analyzing the effects of a coverage gap on drug
utilization and spending;
Determining the impact of Part D coverage on non-
pharmaceutical treatments and services use;
Evaluating the effect of changing copayments, copay
structures, and coverage limits on beneficiary drug choices and
compliance with drug regimens;
Assessing the extent to which risk adjustment methodology
influences enrollment dynamics;
Assessing the impact of adding a prescription drug benefit
on health outcomes of beneficiaries;
Researching the extent to which disparities in care (based
on race, socioeconomic status, rural residence, etc.) might be affected
by Part D; and
Understanding the impact of Part D on related public
programs, such as the State Children's Health Insurance Program
(SCHIP), SPAPs, Medicaid, and the VA.
Commenters also noted that being able to explore how Part D
functions on its own and in relation to other parts of the Medicare
program is essential to guiding future policy decisions. They further
assert that use of Part D claims data is critical to CMS's credibility
and should be considered as part of the Secretary's value-based health
care purchasing initiative. Without access to Part D claims data for
research and other purposes, CMS will limit its ability to monitor
expenditures for the new program, to study the impact of the program on
public health, and to respond to Congressional requests for
information.
Response: We agree with the many comments that Part D claims data
will be essential to us for reporting, conducting program evaluations
and demonstrations, research analyses, and other public health
functions. We also agree that research uses of these data should help
promote and protect the health and well-being of Medicare
beneficiaries. While we believe these uses were implied in the
regulatory text set forth in the proposed rule, we are expanding the
list of necessary and appropriate purposes for which data will be
collected in this final rule to address public health functions
specifically.
Comment: Commenters expressed widespread support for using Part D
[[Page 30670]]
claims data to improve our knowledge base on medication adherence and
other aspects of pharmacotherapy among the elderly and disabled. Some
specific suggested uses of Part D claims data for this purpose include
the following:
Describing current medication use among the elderly and
disabled and examining trends, specifically enhancing our awareness of
poly-pharmacy, off-label uses, avoidance of contraindicated drugs and
dangerous drug-drug interactions.
Examining the extent to which Medicare beneficiaries
receive medicines according to evidence based guidelines.
Assessing whether beneficiaries are adhering to prescribed
therapy, and if not, the clinical and economic impact of nonadherence.
Testing new interventions to improve medication
prescribing and adherence.
Evaluating the impact of medication therapy management
programs mandated under the new Medicare prescription drug benefit.
Response: We consider examining medication use, inappropriate use,
and factors influencing medication adherence in the Medicare population
to be crucial aspects of Part D program monitoring and evaluation, and
public health. As noted by commenters, the Congress mandated that we
examine best practices of medication therapy management, and Part D
claims data are critical for our being able to complete that study.
Comment: A few commenters noted that sharing of research results is
critical to CMS credibility and should be considered part of the
transparency initiative.
Response: We recognize Part D claims data research, and any
subsequent results, are critical to evaluating multiple aspects of the
Medicare Prescription Drug program. Many quality measures developed by
the American Medical Association Physician Consortium and National
Committee for Quality Assurance, and subsequently adopted by Ambulatory
Care Quality Alliance, and the Hospital Quality Alliance require Part D
claims data to run the measures. All of the following quality measures
involve Part D claims data: Drug Therapy for Lowering Cholesterol,
Beta-Blocker Therapy within 7 days post myocardial infarction, and
Beta-Blocker therapy at 6 months post myocardial infarction. These
measures will be used by many of the Better Quality Information to
Improve Care for Medicare Beneficiaries Project pilots, including the
new local collaboratives being chartered under the Secretary's value-
based health care initiative to foster public reporting. All of this
makes Part D claims data an integral part of our transparency efforts.
Thus, in this final rule, we are clarifying our intent to use Part D
data for these necessary and appropriate purposes by adding
``supporting quality improvement and performance measurement
activities'' as an explicit use of these data under Sec.
423.505(f)(3).
Comment: A commenter asserts that we did not adequately justify the
use of Part D claims data by the Secretary for public reporting
purposes, apart from its use to develop reports to the Congress, which
may become publicly available records.
Response: As we stated in the proposed rule, we believe it is
appropriate and necessary for the Secretary to use Part D claims data
for the purposes of reporting to the Congress on the effectiveness and
performance of the prescription drug benefit--including reporting that
is not related to payment. In addition, we may need Part D claims data
to report to the public on aggregate statistics associated with the
Part D program. Finally, the Secretary has determined that it is
necessary and appropriate, under section 1860D-12 of the Act, that the
public should have access to certain data, so that the public may
monitor the progress of the Part D program and, in fact, perform
research that will improve the health of, not only Medicare
beneficiaries, but all Americans. This is why we have created Part D-
related public use files relating to plan benefits and formularies (for
example, files such as geographic locator files, plan information
files, formulary files, beneficiary cost files, pharmacy network files,
and record layout files as described at http://www.cms.hhs.gov/
NonIdentifiableDataFiles/09_
PrescriptionDrugPlanFormularyandPharmacyNetworkFiles.asp.). We may also
create additional public use files subsequent to the publication of
this final rule.
Comment: Several commenters suggested that the reporting of overall
statistics and development of evaluations and/or legislative proposals
can be achieved without CMS having to use or disclose the Part D
sponsors' Part D claims data. The commenter suggested that CMS use
information that is separately collected from the claim to develop
statistics, noting however, that this information will not necessarily
allow CMS to do every type of analysis described in the proposed rule.
Additionally, CMS could partner with one or more sponsors to use their
data, alone, or in combination, to do additional statistics and
analysis.
Response: Although we are willing to partner with plan sponsors as
needed, we do not believe that voluntary cooperation by Part D sponsors
would provide the kind of comprehensive data sets we need to perform
the research, evaluations, reporting and other functions that are
described this final rule. Voluntary agreements with plan sponsors
would lead to an incomplete file of data. In addition, because we
possess the authority under section 1860D-12(b)(3)(D) of the Act to
collect Part D claims data, we do not believe an exclusive reliance on
such voluntary agreements is necessary.
Comment: A commenter noted that a recent Report to Congress
recommended that the Secretary should have a process in place for the
timely delivery of Part D data to congressional support agencies to
enable them to report to the Congress on the drug benefit's impact on
cost, quality, and access.
Response: We agree that congressional support agencies should have
timely access to appropriate Part D data. This final rule allows
congressional oversight agencies access to all elements on the Part D
claim in order to carry out their functions. Like other agencies
outside of CMS, such congressional agencies would be subject to our
minimum necessary policies and data sharing policies. Thus, we would
release only the minimum amount of Part D claims information necessary
to support given projects. In addition, as discussed later in this
preamble, the Congressional Research Service has the authority to
require data releases only when acting on behalf of a committee. Thus,
that agency would be treated the same as a congressional oversight
agency when acting on behalf of committee. Otherwise, it would be
subject to the same restrictions that apply to external entities in our
regulation.
Comment: Several commenters requested that we establish specific,
explicit procedures to ensure that if comparative effectiveness or
safety research informs coverage or payment decisions for specific
items and services (whether decisions are made by CMS or its agents
under Parts A and B or by private plans under Part D), stakeholders
have an opportunity to evaluate the evidentiary basis of proposed
decisions and provide input.
Response: Since our proposed rule did not address the development
of national coverage or payment decisions, but rather our access to
Part D claims data, we believe that our development of coverage or
payment decisions is beyond the scope of this rulemaking.
[[Page 30671]]
We do note that section 1860D-4(b)(3) of the Act requires pharmacy and
therapeutic committees to base clinical formulary decisions on the
strength of the scientific evidence and standards of practice. We have
issued further formulary guidance available at http://www.cms.hhs.gov/
Pharmacy/07_Formulary%20Guidance.asp#TopOfPage.
Comment: Some commenters noted potential uses for Part D claims
data, linked with Parts A and B data, which extend beyond research into
the actual provision of care, including disease management.
Response: We believe the implementation of disease management
programs and the evaluation of these programs could potentially be
strengthened by the use of Part D claims data. However, we believe
these data must be used with caution for these purposes since we
collect Part D claims data only for Medicare Part D enrollees. We do
not collect drug claims data for those beneficiaries who receive their
drug insurance solely from other sources, such as employer or retiree
sponsored health plans, the Veterans Health Administration, or TRICARE.
Comment: Some commenters noted that Part D claims data can help
improve Medicare's current basis of risk adjustment for plan payments.
Response: Section 1860D-15(d)(2)(B) of the Act provides us
authority to use Part D claims data for determining Medicare payments
to prescription drug plan sponsors. This includes their use for
refining our drug plan payment system. Thus, when claims data are used
for risk adjustment they are collected under section 1860D-15 of the
Act, and not under section 1860D-12 of the Act.
Comment: A commenter recommended adding the phrase ``and pilot''
into the text of the Sec. 423.505(f)(3)(iv), so that the regulation
would read ``The Part D plan sponsor agrees to submit to CMS * * *
[d]ata included in drug claims submitted by Part D plan sponsors, as
the Secretary deems necessary and appropriate for purposes including
but not limited to * * * [(f)(3)(iv) c]onducting demonstration and
pilot projects and making recommendations for improving the economy,
efficiency, or effectiveness of the Medicare program.'' The commenter
wants to ensure that Medicare Health Support Organizations are able to
access Part D claims utilization data.
Response: We agree that pilot projects, as appropriate, should have
access to these data, as appropriate, and have added the phrase ``and
pilot'' to Sec. 423.505(f)(3)(iv).
Comment: Several commenters requested that the list of purposes for
which the data would be used be expanded to include program integrity.
Response: We agree that it is important that our program integrity
components have access to necessary data in order to protect the
program. The existing regulation at Sec. 423.322(b) already allows
information collected under section 1860D-15 of the Act to be used in
determinations of payments and payment-related oversight and program
integrity activities. To the extent that program integrity activities
may include investigations of issues that are not directly payment-
related, this rule will provide access to Part D claims data for these
purposes.
Comment: One commenter requested we clarify in the final rule that
Part D claims data can be used by CMS to oversee and protect the
program. Other commenters stated that we should clarify that Medicare
Drug Integrity Contractors (MEDICs) can obtain Part D claims data where
necessary to fully investigate complaints and fraudulent claims.
Response: Our regulations already address use of payment data for
payment-related oversight. We are constantly working with our MEDICs to
determine the types of data to which they will have access. However, we
believe our interactions with our contractors involve internal agency
procedures, and are not the subject of this final rule.
C. Sharing Data With Entities Outside of CMS (Final Sec. 423.505(f)(3)
and (l) Through (o))
As stated in the October 18, 2006 proposed rule, in addition to
collecting Part D claims data for use in administering the Medicare
Part D program under the authority of section 1860D-12(b)(3)(D) of the
Act, we also believe that it is in the interest of public health to
share the information collected under that authority with entities
outside of CMS. When information is collected under the authority of
section 1860D-12(b)(3)(D) of the Act, we do not believe that the
statutory language in section 1860D-15(d) and (f) of the Act (requiring
the information collected under the authority of that section to be
used only in implementing such section) would apply, since any
collection would be effectuated outside of section 1860D-15 of the Act.
Therefore, as we stated in the October 18, 2006 proposed rule, we
proposed to add a new Sec. 423.505(f)(5) to the regulations (now Sec.
423.505(l) and (m)) that would specify that we could use and share the
Part D claims information we collect under Sec. 423.505(f)(3), without
regard to any restriction included in Sec. 423.322(b). In response to
comments, we clarify in this final rule that our regulation permitting
release of Part D claims data to other government agencies and outside
entities is authorized by section 1106 of the Act.
1. Other Government Agencies
We stated in the proposed rule that the Department of Health and
Human Services' (DHHS') public health agencies such as the National
Institutes of Health (NIH), the Food and Drug Administration (FDA), and
the Agency for Healthcare Research and Quality (AHRQ) have, or support,
researchers that would need to use Medicare Part D prescription drug
event data for studies, and other projects, to improve public health
consistent with the missions of these agencies. We also stated that
oversight agencies may need access to both aggregated and non-
aggregated claims data in order to conduct evaluations of the Part D
program that are unrelated to payment and therefore not authorized
under section 1860D-15 of the Act. In addition, agencies in the
legislative branch, such as the GAO, MedPAC, and CBO, may need access
to data in order to evaluate the program. We continue to believe this.
We also continue to believe that other agencies within DHHS, such
as the Centers for Disease Control and Prevention, the Health Resources
and Services Administration, or the Office of the Assistant Secretary
for Planning and Evaluation, may also need Part D claims data to
perform evaluations or assess policies. However, we note specifically
that OIG has independent authority to collect Part D claims data from
Part D sponsors to perform its statutory duties in accordance with the
Inspector General Act of 1978, as amended, 5 U.S.C. App. This final
rule provides OIG an additional avenue for access to these data for
both payment and nonpayment purposes.
Given these necessities, we proposed to allow broad access for
other Federal government executive branch agencies to our Part D claims
data, linked to our other claims data files. As stated in the preamble
of the proposed rule, other agencies generally would enter into a data
sharing agreement, similar to what is used today. This would allow the
sharing of event level cost data, protect the confidentiality of
beneficiary information, and ensure that the use of Part D claims data
serves a legitimate purpose. We also stated in the proposed rule that
we would also ensure that any
[[Page 30672]]
system of records with respect to Part D claims data is updated to
reflect the most current uses of such data.
In the proposed rule, we requested comments that would help us in
our efforts to improve knowledge relevant to the public health.
Specifically, we requested guidance on how we can best serve the needs
of other agencies through the sharing of information we collect under
section 1860D-12(b)(3)(D) of the Act, while at the same time addressing
the legitimate concerns of the public and of Part D plan sponsors that
we appropriately guard against the potential misuse of data in ways
that would undermine protections put in place to ensure confidentiality
of beneficiary information, and the nondisclosure of proprietary data
submitted by Part D plans.
After considering the comments received, we will make Part D claims
data available under a process that builds upon the practice that is
currently in place today with respect to the release of Medicare Parts
A and B data. Thus, we specify in this final rule that, of the data we
collect under the authority of section 1860D-12 of the Act, only the
minimum information necessary, subject, in certain cases, to encryption
and aggregation of certain elements, will be shared with other Federal
executive branch agencies, which would include contractors acting on
their behalf, in accordance with section 1106 of the Act, based on data
sharing procedures established by CMS and agreed to by the Federal
executive branch agency requesting the data. The attached appendix, as
well as our amended rules at Sec. 423.505(m), explain how in this
final rule we would group the governmental entities outside of CMS that
request access to the data collected under 1860D-12 of the Act.
Agencies within HHS, as well as the Congressional oversight agencies
(including CRS when acting on behalf of a committee) would receive only
the elements of the PDEs on the claim that are minimally necessary for
the applicable project. Plan, pharmacy, and prescriber identifiers
would be encrypted unless necessary for the project. In addition, for
States and non-HHS executive branches, the dispensing fee, ingredient
cost and sales tax elements on the claim would be aggregated together
prior to any release, except that, upon request, we will exclude sales
tax from the aggregation at the individual claim level if necessary.
Comment: One commenter objected to the use of the word
``necessities,'' stating that it is not necessary to allow broad access
to Part D claims data.
Response: We continue to believe that it is both necessary and
appropriate for the Secretary to collect the Part D claims data under
section 1860D-12(b)(3)(D) of the Act in order to carry out his broad
range of duties under the Act, including the duties that are listed at
Sec. 423.505(f)(3). Once the Secretary collects the information for
his own necessary and appropriate purposes, we do not believe that the
external release of such information must be categorized as necessary
in order for it to occur, as section 1860D-12(b)(3)(D) of the Act
refers to the collection of, not the release of, data. Release of data
will be authorized under section 1106 of the Act. In addition, any
release will be intended for the benefit of the public health and
welfare.
Comment: Several commenters requested that the FDA play a central
role in any use of Part D claims data for safety evaluations. Others
requested that CMS issue a separate proposal to present CMS and FDA
combined views on sharing of data for public comment. One commenter
also contended that the FDA may not want to use Part D claims data
because of alleged reliability problems and the fact that the FDA may
have problems integrating the Part D claims data with its own
databases. Finally, commenters requested that both agencies allow
manufacturers to review the data and methods used for post-marketing
surveillance.
Response: We do not believe that the FDA's use of Part D claims
data or how the claims data are used in safety evaluations is the
subject of this proposed rule. However, we note that we plan to
exchange Part D claims data with the FDA in accordance with applicable
laws and our data sharing procedures, by entering into appropriate
interagency agreements and data use agreements. Thus, our procedures
for sharing data with the FDA will be the same as those developed for
other government agencies.
Comment: A commenter requested that the Congressional Research
Service (CRS) be able to access the same level of data as oversight
agencies, such as the Office of the Inspector General (OIG), the
Government Accountability Office (GAO), the Congressional Budget Office
(CBO), and the Medicare Payment Advisory Commission (MedPAC).
Response: In the proposed rule we stated that the Congressional
oversight agencies (GAO, MedPAC, and CBO) may require access to data in
order to evaluate the Part D program (71 FR 61452). Although we did not
define CRS as a Congressional Oversight entity, like GAO, it does have
statutory authority to request data (see 2 U.S.C. 166(d)(1)), but only
when it is doing so on behalf of a committee. Accordingly, we are
specifying that CRS will be considered a congressional oversight agency
when the CRS is acting on behalf of committee under 2 U.S.C. 166(d)(1).
Our regulations at Sec. 423.505(m), as well as the attached appendix
outline the data policies that would apply to congressional oversight
agencies, including being subject to our minimum data necessary policy,
our data sharing procedures, and applicable laws. For individually
identifiable information or certain commercially or financially
sensitive information, such as plan identifiers and cost information,
these Congressional oversight agencies will be required to sign a Data
Use Agreement (or provide assurances acceptable to CMS) to protect
against disclosure of such data. When CRS is not acting as the agent of
a committee, however, it does not have the same authority to request
data from departments or agencies of the United States. Thus, we have
specified that in these cases, CRS would be treated as an external
entity, because the agency would essentially be performing research or
analysis on behalf of an individual member of the congress. In
addition, unlike States or other executive branch departments, the CRS
should not need access to plan identifiers or other data on the claim
in order to coordinate care on behalf of beneficiaries. Thus, we have
specified that CRS will be restricted in the same manner as external
researchers, and will not be treated similar to other executive branch
agencies or States.
Comment: A commenter asked CMS to allow for a process that permits
access to Part D claims data in a highly organized way and enables
external entities to replicate any results Federal agencies obtain
using the data.
Response: We believe that our approach to providing access to Part
D claims data, which would follow a review of each request under our
minimum necessary data policy with some additional encryption and
aggregation restrictions based on type of requestor, balances the need
for Part D data in order to conduct legitimate research with the needs
to protect patient information and to preserve the competitive nature
of the Part D program. Therefore, we will review legitimate research
requests and decide whether to release Part D claims information,
consistent with our regulation at Sec. 423.505(m), as well as the
guidance provided in the appendix to this final rule. We expect that
external entities may be able to replicate the results of Federal
analyses for many research questions, such as those
[[Page 30673]]
relating to the utilization of specific drugs or classes of
medications, comparative effectiveness or safety research.
Comment: A few commenters asked that all applicable government
agencies have broad access to the data in a timely fashion without
having to enter into numerous data use agreements (DUA).
Response: As illustrated in our regulation Sec. 423.505(m), as
well as in the appendix to this final rule, non DHHS entities will have
access to the minimum Part D claims data necessary for a given project,
except that certain elements may be encrypted or aggregated. In the
event of a backlog of requests for Part D data under these rules, we
plan to give government agencies first preference in the review
process, and to require such agencies to abide by our data sharing
policies, which generally require a data use agreement. We have
modified or streamlined the data sharing process in the case of certain
Federal law enforcement or oversight entities. For example, we have
streamlined the DUA process for the Department of Justice (DOJ). DOJ
provides a letter for each request for data, which CMS tracks and
monitors.
2. External Entities
As stated in the preamble of the proposed rule, external entities,
such as researchers based in universities, regularly request and
analyze Medicare data for their research studies, many of which are
designed to address questions of clinical importance and policy
relevance. We continue to believe researchers studying a broad range of
topics need access to Part D claims linked to Parts A and B claims
data. As stated in the preamble of the proposed rule, analyses of Parts
A and B claims have contributed to significant improvements in the
public health, have been critical in assessing the quality and costs of
care for patients in the Medicare program, and have, in many cases,
spurred other types of research. As such, we continue to believe that a
data source that includes Parts A and B claims as well as their
attendant Part D claims could be used in a similarly constructive
manner, such that greater knowledge on a range of topics, both clinical
and economic, would be generated. This knowledge is expected to
contribute positively to the evaluation and functioning of the Medicare
program, and to improve the clinical care of beneficiaries.
Also, as stated in the preamble of the proposed rule, we will
specifically address the needs of a segment of external entities as
part of our implementation of section 723 of the MMA, which requires
the Secretary to develop a plan to ``improve the quality of care and
reduce the cost of care for chronically ill Medicare beneficiaries.''
The Congress specifically stated that the plan should provide for the
collection of data in a data warehouse (under section 723(b)(3) of the
MMA). Within the parameters of this regulation, we will implement
section 723 of the MMA by populating a chronic care condition data
warehouse (CCW) which will be accessible by private researchers in
order for such researchers to conduct studies related to improving
quality and reducing costs of care for chronically ill Medicare
beneficiaries.
In addition to the section 723 of the MMA data warehouse, we stated
in the proposed rule that we are planning to make Medicare Part D
claims data linked to other Medicare claims files available to external
entities on the same terms as other Medicare Parts A and B data are
released today, with appropriate protections for beneficiary
confidentiality. We requested comments on the proposed use of the data
for research purposes that would help us in our efforts to improve
knowledge relevant to the public's health, as well as comments on
whether we should consider additional regulatory limitations for
external entities beyond our existing data use agreement protocols in
order to further guard against the potential misuse of data for non-
research purposes, commercial purposes, or to ensure that proprietary
plan data or confidential beneficiary data are not released.
As explained in response to comments, we continue to maintain the
discretion to release the 37 collected PDE elements for legitimate
research purposes, subject to encryption of certain identifiers and
aggregation of cost data to protect beneficiary confidentiality and
commercially sensitive data of Part D sponsors. (These restrictions are
outlined in our regulations at Sec. 423.505(m) as well as in the
appendix attached to this rule.) Furthermore, we also believe Part D
claims data are necessary for use in personal health records and to
ensure the public will be able to access the results of quality
measurement and performance initiatives as discussed in the ``Purpose
of CMS Collecting Information'' section of this preamble. We will
release only the minimum information necessary for a given project. In
addition, data will be disseminated in accordance with applicable laws
via our established data sharing procedures. Thus, the requestor of
data must agree to abide by the restrictions established by our data
sharing procedures in order to receive access to Part D claims data. We
will ensure that our system of records for Part D claims data would
permit the uses of the data described in this final rule.
Comment: In general, the importance of Part D claims data for
improving aspects of public health was a recurring theme among many of
the comments we received. Commenters noted the lack of a comprehensive
source of prescription medication data as one of the greatest
challenges to conducting meaningful research in the elderly. They noted
that Part D claims data will be vital for enhancing disease
surveillance, identifying rare complications of drug therapy, and
improving knowledge about the effectiveness and safety of drugs.
Several commenters underscored that knowledge based on selected aspects
of pharmacotherapy in the elderly or disabled population is limited.
They point out that the very old, patients with multiple chronic
conditions, and those taking multiple medications are routinely
excluded from clinical trials, and assert that research based on Part D
claims data would provide a valuable supplement to the FDA's current
post-marketing surveillance system.
Other themes raised by commenters centered on the current
fragmentation of our health care information and the lack of
information on drug treatment in the elderly. These commenters
suggested that analyses of Part D claims data linked with Parts A and B
data could provide a comprehensive picture of disease treatment, help
guard against siloed policy analyses, and support a broad, disease-
centered research agenda that would advance the essential quality
improvement goals highlighted by the Institute of Medicine in its
report, Crossing the Quality Chasm: A New Health System for the 20th
Century. Commenters also said analyses of Part D claims data would be
beneficial for developing comprehensive estimates of the costs of care,
revealing the most cost effective disease therapies, and understanding
beneficiaries' sensitivity to changes in cost sharing for drugs.
Response: We agree with the many comments that Part D claims data
will be essential for research analyses involving the elderly and
disabled, and for other public health functions.
Comment: Two commenters suggested that CMS implement a tiered
system of access to Part D claims data. Specifically, they suggested we
establish separate tiers for accessing the data, taking into account
the need for data and the opportunity for abuse, which
[[Page 30674]]
would correlate to the following groups: (1) Government agencies; (2)
contractors and researchers under contract with CMS or another
government agency; and (3) outside researchers. They suggest that Part
D claims data be available to the above-listed entities within
appropriate parameters, but not be available to entities, such as
pharmaceutical manufacturers and others with strong proprietary
interests.
Response: We considered several alternatives to the Medicare A/B
data release process including restricting:
Access to HHS agencies only,
Access to Federal Government agencies only,
Access to financial elements for outside researchers.
We rejected these alternatives as too restrictive in light of the
significant benefits to the Medicare program and the public's health in
making Medicare Parts A, B, and D linked data available, with
protections, to Federal and State government agencies, and external
entities. We believe that our approach, which incorporates the Medicare
A/B minimum necessary data policy with additional restrictions to
protect privacy and plan commercially sensitive information, strikes an
appropriate balance between these significant health benefits and the
concerns regarding the release of proprietary data and preserving
beneficiary confidentiality. Moreover, we believe this process has
sufficient protections to ensure compliance with the applicable laws
and guard against the potential misuse of data. External entities
requesting access to Part D claims data will have to enter into an
agreement with us that includes provisions protecting the data from
improper release.
Our regulation at Sec. 423.505(m), as well as the attached
appendix provides additional guidance on the additional limitations
that would apply to external entities (which would include CRS when not
acting on behalf of a committee as an agent, but would not include
States or other executive-branch Federal agencies) requesting Part D
data. Cost data (consisting of ingredient cost, dispensing fee, and
sales tax) could be released only in aggregated form. In addition, plan
and other identifiers generally would be encrypted.
We also intend to only release the minimum data necessary for a
given project. Additionally, we also note that if an entity involved in
a data release of electronic protected health information (EPHI) is a
HIPAA-covered entity, the covered entity will have to comply with our
HIPAA privacy and security standards. In addition, the covered entity
should also follow the security guidance which was released in December
2006. The guidance reinforces our existing security standards to
specifically address remote access and use of EPHI. This reinforcement
of the HIPAA security standards, particularly related to data in
transit, will further protect Part D claims data from inappropriate
release, and therefore inappropriate use. For more information on this
guidance, please log on to http://www.cms.hhs.gov/SecurityStandard/.
Comment: We requested comments on whether we should consider
additional regulatory limitations for external researchers beyond our
existing data use agreement protocols in order to further guard against
the potential misuse of data for non-research purposes, commercial
purposes, or to ensure that proprietary plan data or confidential
beneficiary data are not released. In response, a number of commenters
requested that CMS define the term ``commercial purposes'' clearly and
narrowly so that a broader range of entities would have access to the
data, including pharmaceutical manufacturers, insurance companies, and
pharmacy benefit managers. These commenters argue that instead of
precluding certain types of entities from accessing Part D claims data,
it would be better to focus on assuring researcher quality and
integrity, and on ensuring that researchers adopt sound methodologies
in conducting analyses. Therefore, the commenters request that the
``clear bias'' against pharmaceutical company supported research be
removed from the CMS review criteria.
As noted previously, other commenters suggested that the final
regulation should deny access to data to organizations with strong
proprietary interests, such as drug plan sponsors, pharmaceutical
manufacturers, and other industry data collection entities that sell
market research and sales data.
Response: Under our current policies for Parts A and B data, we do
not provide protected health information (PHI), as defined for purposes
of HIPAA at 45 CFR 160.103, for commercial purposes, as we believe PHI
should only be provided to entities conducting research that will
result in generalizable knowledge in the public domain. We are
concerned about the potential for conflicts of interest where
commercial entities, whose primary purpose is not the creation of
generalizable knowledge, might not publish results contrary to the
firm's financial interest. However, we do allow external researchers to
be funded by commercial firms, including pharmaceutical manufacturers,
insurance companies, and pharmacy benefit managers when the research
will contribute to general knowledge in the public domain and the
researchers are free to publish the results of the research regardless
of the findings. We continue to believe that any findings based on
beneficiary identifiable data released by us should be unbiased by
commercial incentives and should be in the public domain. The criteria
governing releases of protected health information (PHI) for research
are designed to ensure that the HIPAA Privacy Rule's requirements, as
defined at 45 CFR 164.512(i), as well as our own policies are met. In
this final rule, we use the definition of research contained in the
HIPAA Privacy Rule, which defines the term as ``a systematic
investigation, including research development, testing and evaluation,
designed to develop or contribute to generalizable knowledge'' (45 CFR
164.501). Thus, we do not release PHI to external entities when their
research is not designed to develop or contribute to the generalizable
knowledge. Nor do we release PHI to external entities for their
commercial purposes or if they fail to demonstrate that they have a
sound research methodology and that their research will produce
findings relevant to the Medicare program and its beneficiaries.
Therefore, we will continue to apply the same criteria in
distinguishing between who may have access to data (researchers versus
commercial interests), as we have been using for Parts A and B data.
Because we intend to examine whether each proposed use of data meets
the definition of research used under the HIPAA Privacy Rule, we will
not be defining the term ``commercial purposes'' in this regulation.
Comment: We received several comments relating to the Freedom of
Information Act (FOIA), noting that releases under FOIA should not
include information that would be considered proprietary in nature.
Response: If a FOIA request is received, we will follow our
ordinary FOIA procedures and not release under FOIA data the agency
determines are trade secrets, or commercial or financial information
protected by FOIA Exemption 4 (5 U.S.C. 552(b)(4)). These procedures
were explained more fully in the preamble to the Part D final rule,
where, in response to a question about protecting bid information under
FOIA we stated:
[B]idders can always seek to protect their information under the
Freedom of Information Act and label truly proprietary information
``confidential'' or ``proprietary''. When information is so labeled,
the bidder is required to explain the applicability of the
[[Page 30675]]
FOIA exemption they are claiming. When there is a request for
information that is designated by the submitter as confidential or
that could reasonably be considered exempt under Exemption 4, the
Department is required by its FOIA regulation at 45 CFR Sec.
5.65(d) and by Executive Order 12,600 to give the submitter notice
before the information is disclosed. To determine whether the
submitter's information is protected by Exemption 4, the submitter
must show that (1) disclosure of the information is likely to impair
the government's ability to obtain necessary information in the
future; (2) disclosure of the information is likely to cause
substantial harm to the competitive position of the submitter; or
(3) the records are considered valuable commodities in the
marketplace which, once released through the FOIA, would result in a
substantial loss of their market value. Consistent with our approach
under the Part C program, we would not release information under the
Part D program that would be considered proprietary in nature or
that would tend to stifle the availability of discounts or rebates
from pharmaceutical manufacturers negotiated by Part D plans.
Bidders may identify trade secrets and confidential business
information (CBI) with their submission. However, if they have not
we will give them another chance when a FOIA request has been made
on their records. In this case we will notify the business
submitters that we are in receipt of FOIA requests for their
records. We will then provide the business submitters with
instructions and ask them to identify any trade secret or CBI in
order to justify our application of Exemption 4. We will then review
their justifications and highlighted information against FOIA case
law to see if we can support their requested redactions. Under
Executive Order 12600, if the business submitters disagree with our
Exemption 4 analysis (which includes their justification) of their
identified trade secret or CBI, they are provided the opportunity to
seek a restraining order or injunction in Federal court prohibiting
us from releasing their records under FOIA. (70 FR 4294 through
4295)
Thus, for example, we do not expect that any pricing data included
on the claim that fits within FOIA Exemption 4 would be required to be
released under FOIA.
We also note that we do not view data releases made under the
authority of the new Sec. 423.505(m) as FOIA releases. Unlike FOIA
releases, these releases are not required by law. Section 423.505(m)
permits the release of data, but does not require it.
Comment: A number of commenters underscored the importance of CMS
making patient identifiers available in order to achieve the full
potential of Part D data. One commenter stated prescription drug claims
files by themselves lack the diagnostic, outcomes and other information
to support the needed studies. However, when merged with other data,
they can become a powerful tool for improving the public health.
Reflecting the views of several other commenters, the commenter noted
that Part D claims data could be linked to several other data sets such
as: death and birth certificate files; nursing homes Minimum Data Set;
home health care Outcome and Assessment Information Set files; disease
registries such as the Surveillance, Epidemiology, and End Results-
Medicare dataset developed by the National Cancer Institute to study
outcomes of cancer therapies; geographical data on characteristics and
health care resources of communities; information on characteristics of
providers (for example, use of primary medical care versus specialty
care); and Medicaid data on health care encounters and services not
covered by Medicare. The commenter emphasized that linking Part D data
to the above information is essential in order to provide accurate
accounting for outcomes and to best address the many scientific
pitfalls and potential threats to validity that emerge when one moves
from experimental to observational studies, such as unobserved variable
bias and confounding by indication or counter-indication.
Another commenter stated that linkage of the Part D data to
population-based surveys would provide invaluable sources for
epidemiologic, health services and policy analyses and enable
investigations into prevalence of diseases, their risk factors,
progression, and trends in treatment and drug use.
Response: We agree these data are more powerful when linked with
other data sets. Linkage to Medicare Parts A and B data is essential
for understanding the impact of the Part D benefit on use of other
Medicare services. There are a host of other types of research studies
that could not be completed without linked data. These include: studies
examining the impact of changes in benefit structure on patient
outcomes, research into the relative effectiveness of pharmacologic
therapies or medication therapy management interventions, and
pharmacovigilence studies. In many cases, Part A/B linked data provided
through our chronic condition warehouse with encrypted identifiers will
be sufficient to accomplish the research. In cases where beneficiary
identifiers are essential for linkage with non-Medicare data bases,
such as the National Center for Health Statistics Surveys, beneficiary-
identifiable data may be released, but will be subject to the Privacy
Act and HIPAA data security and privacy requirements consistent with
those we require in our data release policies for identifiable Part A/B
data. These requirements include a CMS Privacy Board review/approval,
submission of a Data Use Agreement, and the justification of minimum
data necessary to carry out the project. If the data is going to be
linked to data collected under another federally funded study, the
requestor must also secure the Federal project officer's concurrence
and an Institutional Review Board (IRB) approval.
Comment: A few commenters were concerned that CMS had not
adequately addressed the implications of expanding access to physician
and patient information. They recommended that we specify more clearly
the conditions under which physician data can be collected and used in
performance programs, research studies, and demonstration projects,
noting that revealing physician identification information will enable
pharmaceutical companies and others to influence physicians'
prescribing patterns and interfere with a physician's professional
judgment.
Response: We believe that an encrypted version of the physician
identifier, which will allow for the linkage of all of a physician's
claims without divulging the physician's identity, will meet the needs
of most researchers. Accordingly, we will evaluate research requests
for physician identifiers (for example, that could be used to link
Medicare data at the physician level to other datasets) on a case-by-
case basis and will only consider providing them if necessary for the
study under our minimum data necessary policy and permitted under
applicable law. In addition, we will continue our current practice of
not providing identifiable data for commercial purposes. This
limitation should address the concern regarding pharmaceutical company
interference with medical practice.
In addition to releasing physician identifiers in response to
certain research requests, we anticipate releasing physician
identifiers to States, and pilot and demonstration projects, as the
ability to link all of a physician's claims may be necessary for care
coordination and disease management purposes. Physician identifiers may
also be used by or released to other government agencies or
contractors, as part of populating personal health records, so that
beneficiaries will have a record of who prescribed their drugs.
Finally, we anticipate that they may be used in connection with or
released to support the Secretary's Value-driven Health Care initiative
which seeks to
[[Page 30676]]
improve the quality and efficiency of health care delivery by making
performance measurement information available to better support
provider and consumer health care decision-making.
One of the goals of the Secretary's Value-driven Health Care
Initiative is to promote public reporting of performance measurement
results at the provider and physician level that may be based on public
sector claims, private sector claims, and other data in order to enable
providers, including physicians, and consumers to make informed health
care decisions. We envision using the claims data to develop provider
and physician-level performance measurement results.
Comment: A commenter supported CMS's use of Part D data to manage
cost and clinical quality and argued that providing external parties
access to linked physician identifiable claims in order to pool them
with employer data would allow analysis to reduce the cost of care
delivery and improve the quality of care. The commenter stated that
increasing transparency of care in the outpatient sector is critical
and that protecting physicians from oversight cannot continue.
Response: We are undertaking a variety of pay for performance and
value-based health care initiatives in an effort to encourage health
care providers to furnish high quality health care and in order to
provide cost and quality information to consumers. We intend to use the
Part D claims data in these activities. Similarly, other Federal
executive branch agencies (and their contractors) will have access to
physician identifiers, if appropriate. We are working with external
stakeholders, including multi-stakeholder coalitions that represent
providers, consumers, employers, and health plans, regarding how to
pool Medicare data with private data for analysis and how to make the
results available to the public. As these plans mature, more
information will be shared with the public.
Comment: While many commenters supported the use of Part D claims
data for detecting and analyzing unintended risks and benefits of
medications, they also noted the limitations of claims-based research
for answering questions about the comparative efficacy and safety of
drugs. The commenters asserted that claims-based outcomes research,
such as with Part D claims data, can reveal correlations between
variables or events, but is often not sufficient to establish
causation. They offered specific suggestions such as holding
researchers to high methodological and ethical standards, creating
study panels of qualified external stakeholder experts to review
research protocols, and encouraging CMS to conduct an open and
transparent process that will allow for external verification and
replication of CMS's sponsored analyses.
Response: We are well aware of the limitations involving
retrospective, claims-based research. Our current data release policies
for Parts A and B data for externally-funded research require that a
requestor submit a detailed proposed research protocol. We review these
proposals for the legitimacy and feasibility of the research, the
strength of the proposed methods for guarding the privacy of the data,
and the appropriateness of the research methods. Research requests for
Part D claims data would be subject to the same type of review.
Comment: Some commenters suggest that CMS make available the number
of external requests it receives for claims data, the manner in which
the agency responds to those requests, the timeliness of the approval
process, and any fees charged for various types of data. They also
believe that CMS should describe the Federal priorities for government-
sponsored research using Medicare Part D claims data, and provide for
public notice and comment on proposals based on processes already
established by Agency for Health Research and Quality (AHRQ).
Response: We already maintain data on the number of external
research requests for our claims data, whether the request was
approved, the timeliness of the approval process, and any fees charged
for various types of data. We can make this information available to
the public, upon request, and will explore posting it on our Web site.
We do not believe we should establish Federal priorities for
research using Part D claims data, just as we do not establish
priorities for research using Medicare Parts A and B data. Much of our
research agenda is determined by directives from the Congress for
research studies, demonstrations and their evaluation. Accordingly, a
public comment process on CMS-sponsored research is not necessarily
feasible. However, other Federal government executive branch agencies
that are likely to sponsor comparative effectiveness or safety research
using Part D claims data, such as AHRQ, do have such priority-setting
processes in place. We believe these processes are adequate to address
the commenters' concerns.
Comment: A few commenters suggested that we make available Part D
claims data to State Medicaid directors for the purpose of monitoring
and researching the dual eligible population. The commenters suggested
we provide States with access to the drug utilization and spending data
collected by the Medicare Part D prescription drug plans, as well as
other data necessary for states to effectively coordinate the care of
dual eligibles.
Response: We believe that States may improve their disease
management and other care coordination programs by examining
utilization data of dual eligibles extracted from Part D claims. In
this final rule, we have clarified that we will be permitted to use
collected Part D claims data for care coordination and disease
management purposes. Under Sec. 423.505(m), we may release collected
Part D claims data to States, consistent with our minimum data
necessary policy, our data sharing procedures, applicable laws, and
subject to encryption of certain identifiers and aggregation of cost
data. We plan to explore the operational issues associated with such an
exchange. As a result, we believe States will have appropriate access
to Part D claims data for purposes of coordinating the care of dual
eligible beneficiaries. Please see Sec. 423.505(m), as well as the
appendix to this final rule for additional explanation of how we would
determine the data that would be released to States.
Comment: Commenters requested further discussion on the types of
entities to which collected Part D claims data will be released. A
commenter also contends that the recipients of data could share the
data with third parties of their choice.
Response: Identifiable data are not released to all external
requesters. Currently, for Parts A and B data, external researchers
must request the identifiable data from us. Our privacy board reviews
the request for beneficiary identifiable data to determine if the
request is for an appropriate research purpose, whether the Privacy
Rule's criteria are met, and that the request is consistent with our
data release policies. Our data release policies do not allow us to
release identifiable data for marketing or commercial purposes.
Further, we do not approve requests from for-profit organizations or
organizations that could profit from a study, although we do produce
databases with identifiers stripped, as well as public use files, for
any organization to use. We also have requirements for release of Parts
A and B data to other Federal governmental entities and contractors for
purposes not related to research. Generally, we use DUAs to track the
disclosure of personally identifiable data to such entities. Under our
data sharing
[[Page 30677]]
policies, we generally require the requester not to disclose the data
to third parties without specific written authorization from us. The
release of data must also be permissible under the Privacy Act, the
HIPAA Privacy Rule, the Trade Secrets Act, and any other applicable
laws.
Comment: A commenter recommended that CMS include a requirement
that the recipient obtain a certification of confidentiality for all
identifiable CMS data covered by the agreement or other data within the
scope of the research project to protect researchers when compelled to
release protected data.
Response: Under section 301(d) of the Public Health Service Act (42
U.S.C. 241(d)) the Secretary of Health and Human Services may authorize
persons engaged in biomedical, behavioral, clinical, or other research
to protect the privacy of individuals who are the subjects of that
research. This authority has been delegated to the National Institutes
of Health (NIH). Certificates of confidentiality are issued to protect
identifiable research information from forced disclosure. Certificates
of confidentiality may be appropriate for research that combines the
direct study of human subjects with the use of identifiable Part D
data. They allow the investigator and others who have access to
research records to refuse to disclose identifying information on
research participants in any civil, criminal, administrative,
legislative, or other proceeding, whether at the Federal, State, or
local level. Certificates of confidentiality may be granted for studies
collecting information that, if disclosed, could have adverse
consequences for subjects or damage their financial standing,
employability, insurability, or reputation. By protecting researchers
and institutions from being compelled to disclose information that
would identify research subjects, certificates of confidentiality help
achieve the research objectives and promote participation in studies by
assuring confidentiality and privacy to participants. The Department
would encourage researchers to explore with their institutional review
boards or other knowledgeable experts the use of certificates of
confidentiality where appropriate. If a researcher has obtained a
certificate of confidentiality for a human subjects study, its
protection would extend to all individually identifiable data on the
research subjects in that study (including Part D data.) maintained in
the research records. Additional information about certificates of
confidentiality is available on our Web site at http://grants2.nih.gov/
grants/policy/coc/.
Comment: Several commenters stated their concern that the proposal
would run afoul of Federal confidentiality protections for substance
abuse laws such as 42 CFR Part 2.
Response: As the commenter notes, regulations at 42 CFR Part 2
``Confidentiality of Alcohol and Drug Abuse Patient Records,''
establish restrictions on the disclosure and use of alcohol and drug
abuse patient records that are maintained in connection with the
performance of any Federally-assisted alcohol and drug abuse program.
These regulations limit disclosures of any patient-identifying
information acquired by a Federally-assisted facility that provides
alcohol or drug abuse diagnosis, treatment, or referral for treatment.
We will work with Part D sponsors to ensure that these specifically
protected claims are not redisclosed for purposes other than payment.
One option that we plan to explore to comply with these regulations is
to identify a set of drugs which are used for the treatment of alcohol
and substance abuse (that is, Anatabuse and Vivtrol) and exclude
associated PDEs for these drugs from any sample of PDEs used for
purposes other than carrying out section 1860D-15 of the Act (that is,
for nonpayment purposes).
Comment: We received a number of comments on how the rule will be
implemented. Commenters requested that CMS ensure that: Part D claims
data file formats are consistent with other CMS data files; limited
data sets (LDS) be available linking Medicare Parts A, B and D data;
and files be in a clean format that is sufficiently detailed and
secure. Other commenters requested that Part D claims data be made
available in a linkable format that includes details of prescriptions
by patient, time, and location, in order to address the shortcomings in
the current management of chronic diseases.
Response: We do not believe that the detailed formatting standards
requested by the commenters are an appropriate subject of this final
rule. However, we recognize the need to ensure appropriate security of
data, and will apply the processes and procedures regarding the
transmission and storage of data currently in place to protect Parts A
and B data to Part D claims data. We also note that linked data files
will contain both a patient's chronic conditions and detailed
information regarding prescriptions.
Comment: Several commenters recommended that CMS consider
developing and releasing a summary file that parallels the current
Physician Supplier Procedure Summary Master file along with a 5 percent
sample standard analytical file. One commenter asked that both LDS
files and Research Identifiable files be available and asked for
clarification of the file types available from the CCW.
Response: As stated, we do not believe that detailed formatting
standards are the subject of this final rule. We also note that both
LDS files and research identifiable files are available from the CCW.
We anticipate filling most research requests for Part D claims data
using LDS files available from the CCW or from other places.
Comment: One commenter questioned how plan sponsors are to comply
with applicable State privacy laws that may preclude disclosure of
medical information for one or more of the purposes listed in the
proposed regulatory text. The commenter requested that CMS explain
whether any such conflicting state law prohibitions would be preempted
by the proposed regulation, notwithstanding that Sec. 423.136 of the
regulations states that state confidentiality and disclosure laws are
not preempted.
Response: Part D sponsors should comply with all applicable Federal
and state confidentiality and disclosure laws when not directly
conflicting. Part D regulations specifically require prescription drug
plans to comply with these laws. If there is a belief that a particular
State law is in direct conflict with our Federal requirements, plan
sponsors should bring those specific cases to our attention for
individual review.
Comment: One commenter contended that CMS can share Part D claims
data freely with its contractors, who may also be researchers, under
section 1860D-15 of the Act.
Response: Section 1860D-15 of the Act only relates to disclosures
necessary to carry out that section, which would permit sharing of Part
D data with contractors only for payment purposes. This regulation,
which is established under the authority of section 1860D-12 of the
Act, would permit us to collect the original 37 PDE elements comprising
the Part D claims data for nonpayment-related purposes, and allow the
agency and its contractors to use them for nonpayment-related purposes
(section 1874 of the Act permits the Secretary to perform his functions
by contract).
Comment: A commenter contends that it is impossible to assess the
intent of CMS without the ability to review the system of record notice
for data collected under Part D. The commenter
[[Page 30678]]
wants CMS to republish the proposed rule along with the applicable
system of records notice.
Response: We believe the proposed rule contained enough information
for interested parties to assess our intent. We plan to publish a
revised system of records notice shortly to ensure that the regulation
and its system of records are effective as close to the same time as
possible.
Comment: One commenter stated CMS should complete a Privacy Impact
Assessment (``PIA'').
Response: We annually update all appropriate PIAs. Accordingly, we
will be updating the Drug Data Processing System PIA every year.
Comment: A commenter recommended that the subjects of any data
disclosed to a third party be parties to CMS's data use agreement, so
that they may seek relief for a breach of the agreement.
Response: The format and procedures for our data sharing agreements
are not strictly within the scope of this final rule. Moreover, we do
not believe the commenter's recommendation would be advisable because
it may significantly hamper the ability of researchers to perform the
activities that benefit the public's health under this rule.
Researchers may ultimately expend an enormous amount of resources
responding to third party claims. However, we do note that signatories
of our data use agreements can be sanctioned if they violate the
agreement or Federal law.
Comment: We received several comments suggesting that we establish
a process for reviewing research requests based on a `first in, first
reviewed' process.
Response: The internal procedures we use in reviewing requests for
data are not strictly within the scope of this final rule, as the
proposed rule did not make recommendations related to our data-sharing
process. However, we do plan to continue the practice of giving
government agencies first preference in the review process, and to
require that such agencies abide by our data sharing procedures, which
generally require a data sharing agreement.
External research requests are usually reviewed in the month they
are received with the exception of time sensitive research requests,
which may be considered in an expedited manner, at our discretion.
Because we expect a large volume of requests, there may be a delay
between when a request is received, reviewed, and approved or denied.
As we do currently with Parts A and B data requests, we will continue
to carefully consider each research request with a review process that
emphasizes compliance with applicable laws, including those governing
the protection of privacy, first, followed by legitimacy of the
requested study, and the requestor's expertise.
D. Beneficiary Access to Part D Claims Data
The proposed rule stated that we were considering the use of Part D
claims data for projects involving the development or population of
personalized health records, which include beneficiary medication
history, which would be accessible by Medicare beneficiaries or their
providers after the beneficiary consents to such a release. We
requested comments on this proposed use of Part D claims data collected
under the authority of section 1860D-12(b)(3)(D) of the Act.
In this final rule, after considering the comments received, we are
expanding the use of the collected Part D claims data so that we may
authorize the use and release of these data to government contractors
or external entities for the population of personal health records.
Comment: Generally, commenters encouraged CMS to pursue projects of
this nature, with one commenter in particular noting that the
personalized medication history record could be linked to the
MyMedicare.gov Web site and could include links to a beneficiary's Part
D plan, its formulary, and the plan's instructions for prior
authorization requests.
A few commenters requested more detail regarding the development of
PHRs, the protection of beneficiary health information, and the Web-
based standards (that is, record security, record retrieval, browser
compatibility, etc.) underlying the display of PHRs. They suggested
that we use a transparent, public process for developing these ideas
and allowing for public comments. One commenter referenced the URAC
(the organization formerly known as the Utilization Review
Accreditation Commission) standards for Web-based clinical content and
another, the Medicare pilot demonstration project conducted by the
United Mine Workers Health and Retirement Fund as a model of a project.
Response: Currently, we are conducting pilot projects and studies
on personal health records that include the disclosure of hospital and
provider claims data (Part A and Part B) to populate beneficiaries'
PHRs. However, until this rule is effective, we cannot include Part D
claims data in these projects. When we have authority to disclose Part
D claims data, we will provide the Part D claims data to populate PHRs
only upon the authorization of the beneficiary. We require our partners
in PHR pilots and studies to agree to strict privacy and security
safeguards whenever receiving, using or disclosing beneficiary data.
The pilots and studies are intended, in part, to help inform us in
developing privacy rules and security arrangements that would be
appropriate for a program of ongoing disclosures to populate and update
the PHRs, as authorized by beneficiaries.
In the area of health information technology, the Department has a
history of developing policy in a collaborative, open, and transparent
manner. In addition to obtaining public comment through notice in the
Federal Register, such as this, the Department relies on its public
advisory committees, relationships with industry, and participation in
professional associations in developing policies and procedures with
respect to the emerging health information environment. With regard to
PHRs, the information we gather through this process will also help us
determine future steps.
Comment: Several commenters stated that beneficiary participation
in such projects should not be mandatory, but voluntary.
Response: We expect that any program we plan to undertake to make
collected Part D claims data available to beneficiaries would be
voluntary on the part of beneficiaries.
Comment: A commenter noted that beneficiaries already have the
right to request access to, inspect, and copy their medication
histories and other PHI.
Response: We appreciate the commenter's statements that
beneficiaries already have access to their medical records, but believe
that a centralized PHR that is easily accessible from a Web site, and
that includes a more comprehensive set of data from multiple providers
and prescribers, would be of use to beneficiaries.
Comment: A commenter urged CMS to establish procedures where the
data will be automatically available to other health care practitioners
and institutions. The commenter stated that a beneficiary may be unable
to release the record due to being unconscious or confused. Finally,
the commenter noted reasons why, under Parts A and B, the personalized
EHR is necessary, including the value of having a complete record in an
emergency room situation and in instances when a physician administers
medications incident to a physician visit.
Response: Any PHI that CMS releases to providers or institutions
would be
[[Page 30679]]
authorized by the beneficiary or the beneficiary's authorized
representative or would be otherwise permitted or required under the
applicable laws and our policies. Moreover, we note that health care
providers are not necessarily the intended users of PHR; rather, they
are intended for use by the patient. We believe it more likely that
emergency room and other health care providers would have access to
patient's medication history from another source.
Comment: One commenter noted that Part D claims data may be of
limited value in creating a PHR.
Response: We believe that access to medication history information,
even of limited scope, is deemed one of the top priorities by emergency
responders, emergency room personnel and physicians, in discussions
regarding electronic PHRs.
Comment: A commenter noted that PHR information shared with
entities other than the beneficiary should only be released in an
aggregated format without any physician identifiers.
Response: We requested comments on the usefulness of creating a
personalized beneficiary medication history record from the Part D
claims data. We are uncertain as to why the commenter believes it would
only be appropriate for physician information to be released at the
aggregate level since the purpose of PHRs is to allow individuals and
their providers to have access to information to improve the quality
and delivery of care to the individual. Any sharing of this data with
organizations that assist beneficiaries in developing their own PHR
would need to be authorized by the individual to whom the record
pertains, just as the individual would provide authorization for
release of any other of his or her personal data held by Medicare.
E. Applicability
We stated in the proposed rule that the proposed revision does not
affect the applicability of HIPAA to the DHHS or any other appropriate
parties, nor does it affect the applicability of the Privacy Act (5
U.S.C. 552a) or the Trade Secrets Act (18 U.S.C. 1905). Thus, Part D
claims data, like any personally identifiable information or PHI
collected by the agency, are subject to protection under the HIPAA
Privacy Rule, the Privacy Act and the Trade Secrets Act, and other
laws, as applicable. In this final rule, we continue to take this
position.
Comment: One commenter stated that the proposed rule does not
explain why HIPAA does not apply to Part D activities when HIPAA does
apply to CMS activities for Parts A and B of Medicare.
Response: The HIPAA Privacy Rule applies to covered entities and
defines the term ``covered entity'' as (1) a health plan, (2) a health
care clearinghouse, or (3) a health care provider who transmits any
health information in electronic form in connection with a covered
transaction. (See 45 CFR 160.103.) HIPAA defines ``health plan'' as an
individual or group plan that provides, or pays the cost of medical
care, and specifically includes Part A and Part B of the Medicare
program under title XVIII. (See section 1171(5) of the Act and 45 CFR
160.103 (definition of health plan).) With respect to Part D, because
Part D sponsors meet the definition of health plan, they are covered
entities subject to HIPAA. HIPAA does not apply to the component of CMS
that administers the Part D program because it is does not pay claims
directly. However, although Part D claims information held by this
component is not directly subject to HIPAA, the Part D data are
protected under the Privacy Act of 1974, which applies to all federal
agencies' data collections of individually identifiable information in
systems of records. The Privacy Act requires that CMS maintain Part D
data in a protected system of records and may only use or disclose the
data in accordance with the specific purposes which have been published
in the Federal Register and with other uses and disclosures allowed by
the Privacy Act, itself. See 5 U.S.C. 552a(b) and (e)(4).
This rule will allow the Secretary to use the original 37 PDE
elements that are being collected for Part D payment purposes for
reporting to the Congress and the public, conducting evaluations of the
overall Medicare program, making legislative proposals to Congress, and
conducting demonstration projects. To the extent that such information
becomes part of our administration of the Medicare Part A and Part B
programs, HIPAA will apply to such information. Moreover, although Part
D claims information held by the component of CMS that administers the
Part D program are not directly subject to HIPAA, we are choosing to
comply with HIPAA's limitations on the use and disclosure of PHI to
ensure that beneficiaries' privacy interests are fully protected. In
addition, we are choosing to impose standards similar to those applied
when we release beneficiary identifiable information with respect to
non-beneficiary identifiable Part D data, on the PDE, such as plan,
prescriber, and pharmacy identifiable data.
Comment: One commenter noted that many plan sponsors already share
data with agencies such as the FDA, NIH, and AHRQ, and external
entities subject to HIPAA, therefore there is no need for this
rulemaking.
Response: While plan sponsors may already share data with agencies
such as FDA, NIH, and AHRQ, only CMS can share Part D claims data
linked to Medicare Parts A and B data. Therefore, we maintain that this
rulemaking is necessary.
Comment: Some commenters expressed concern with CMS' use of data
use agreements. They asked that CMS explain the steps we will undertake
to ensure the confidentiality of individually identifiable beneficiary
data.
Response: In response to the commenter's concerns about CMS'
reliance on data use agreements (DUAs), we administer DUAs for any data
disclosures to external entities, including limited data sets that
exclude certain personal identifiers. The DUA is a way to ensure that
the data provided are only used for the purposes for which the data
were disclosed. All external requests for personally identifiable data
for research are subject to CMS' Privacy Board review and approval.
Currently, for Parts A and B data, CMS restricts data releases to
the minimum amount of information necessary for the requestor's
specific research project. We intend to operate on the same basis, with
some additional restrictions to protect privacy and commercially
sensitive information as described our regulations at Sec. 423.505(m)
as well as in the appendix to this final rule, with respect to the
release of collected Part D claims data. We anticipate that we will be
able to satisfy many requests for Part D claims data using limited data
sets, which exclude certain personal identifiers.
Comment: A commenter was concerned with the release of prescriber
identifiers, believing that the release of such data could be used to
target marketing efforts and otherwise improperly affect a prescriber's
judgment.
Response: As explained previously in section II.B. of this final
rule, we expect that the results of the Secretary's quality improvement
and performance measurement initiatives may be made public in an effort
to financially reward health care providers who provide high quality
health care and to provide cost and quality information to consumers.
Beyond that, we will encrypt prescriber identifiers as a general matter
with limited exceptions (see 42 CFR 423.505(m), as well as the appendix
to
[[Page 30680]]
this final rule). Additionally, we will not release Part D claims
information for commercial purposes.
Comment: A commenter contended that for a HIPAA-covered entity the
proposed rule will impose a substantial compliance burden and monetary
costs to transform each prescription drug claim that a plan sponsor
submits for payment purposes into an accountable disclosure that the
plan sponsor would need to track in order to fulfill its accounting of
disclosures obligations under the HIPAA Privacy Rule. The commenter
also stated that the proposal may burden plan sponsors by possibly
requiring many to distribute revised notices of privacy practices,
which may cause beneficiary confusion. The commenter states that CMS
should be precluded from implementing the proposed rule except at the
beginning of a calendar year.
Response: Regularly, laws and regulations intersect or overlap, and
individuals and entities are required to dissect the application of
such laws and regulations, as appropriate. This rule does not regulate
how covered entities, subject to HIPAA compliance, must comply with the
HIPAA Privacy Rule, nor was it intended to do so. As a general matter,
Part D plan sponsors are subject to a wide range of Federal laws and
regulations, including HIPAA, and in this instance there may be an
intersection between such laws and regulations that requires analysis
and consideration. As we noted in the preamble to the proposed rule,
nothing in this final rule affects the applicability of HIPAA (or the
Privacy Act) to the DHHS or any other appropriate parties.
Since the proposed rule did state that it did not affect the
applicability of HIPAA, we believe a brief discussion of the
intersection between this rule and existing HIPAA rules is warranted.
However, it is important to note that the Office for Civil Rights (OCR)
is the only agency within DHHS that can provide advice on and enforce
the HIPAA Privacy Rule. Affected entities can obtain comprehensive
information regarding the HIPAA Privacy Rule, including answers to
frequently asked questions and information on the enforcement program,
at http://www.hhs.gov/ocr/hipaa/.
With this in mind, we believe that private plans are permitted by
the HIPAA Privacy Rule to make the disclosures provided for in this
Rule. The HIPAA Privacy rule permits disclosures for health oversight
and as required by law. See 45 CFR 164.512(a) and 164.512(d). We are
not suggesting that the HIPAA definition of ``required by law'' at 45
CFR 164.103 encompasses contractual requirements. Rather, we believe
those disclosures required by contract, which are also mandated by
statute or regulation or both, would be ``required by law'' under the
HIPAA Privacy Rule.
As noted previously above, plans disclosing data under this rule
may face HIPAA compliance issues regarding accounting and Notice of
Privacy Practices. We believe that most Part D plans very likely have a
statement in their existing Notices of Privacy Practices that notifies
enrollees of permitted disclosures for purposes of health oversight and
as required by law, and therefore, are unlikely to have to modify their
notices of privacy practices.
An individual also has the right under the HIPAA Privacy Rule to
receive an accounting of certain disclosures, including disclosures for
health oversight purposes or disclosures required by law. It is each
plan's responsibility to comply with the HIPAA Privacy Rule as it deems
appropriate.
Finally, we do not believe that any further delay in the effective
date for this regulation is required. We believe the commenters are
referencing the prohibition on mid-year significant regulatory
requirements at 42 CFR 423.516. However, that regulation does not apply
to already-existing regulations, such as HIPAA regulations, or the
impact already-existing regulations will have on a new Part D
regulation. Because we already collect Part D claims data, this
regulation does not impose additional Part D requirements on Part D
sponsors, and therefore, we do not view this regulation as constituting
a significant midyear change for Part D sponsors.
Comment: The commenter also questioned how CMS would notify
beneficiaries that their data may be released for research purposes.
Response: As a general matter, how we comply with our own HIPAA
obligations is outside the scope of the proposed rule. To the extent
HIPAA requires us to take any additional steps (including additional
notification responsibilities) to ensure full compliance with HIPAA, we
intend to do so. For instance, a covered entity is required to include
in its notice of privacy practices a statement that PHI may be used for
research purposes. CMS, as a covered entity for Medicare Parts A and B,
currently provides such notice to beneficiaries annually.
Comment: Several commenters requested that CMS discuss the
regulation in light of the Trade Secrets Act, specifically with respect
to pricing data.
Response: Because our regulations at 42 CFR 423.505(f), (l), and
(m) are issued under the authority of section 1106 of the Act, any
release of potentially proprietary data under these regulations would
also be authorized by law under the Trade Secrets Act. As we have
stated elsewhere in this preamble, we believe that our minimum data
necessary policy with some additional restrictions to protect privacy
and plan commercially sensitive information and our data sharing
procedures will guard against any potential misuse or inappropriate
disclosure of Part D claims data.
F. Limitations
This final rule in no way affects or limits our existing ability to
collect non-payment data such as enrollment, formulary, price
comparison, quality assurance and utilization review data. In such
cases, even where the data collection is not specifically mandated by
statute, we do not believe it is necessary to resolve any statutory
ambiguity, because section 1860D-15 of the Act would not apply.
In addition, it is important to note that this rule applies when
collections of data occur under section 1860D-12 of the Act. The rule
does not address collections that occur under other provisions of law.
Thus, this rule also does not address uses or disclosures already
permitted under section 1860D-15 of the Act, to carry out audits and
evaluations necessary to ensure accurate and correct payment and to
otherwise oversee Medicare reimbursement under Part D. These uses are
already contemplated under both the statute and the regulations at
Sec. 423.322(b). Furthermore, section 1860D-15 of the Act and Sec.
423.322(b) of our regulations do not limit the ability of OIG to
access, use, or disclose Part D claims data as part of the Inspector
General's statutory responsibilities to oversee the Medicare program.
III. Provisions of the Final Regulations
This final rule finalizes most of the provisions of the proposed
rule. Those provisions of this final rule that differ from the proposed
rule are as follows:
In part 423, adding section 1106 of the Act to the
authority citation.
In Sec. 423.1, adding section 1106 of the Act.
In Sec. 423.505, making the following changes:
++ Revising paragraph (f)(3) to clarify that the regulatory
provision is only applicable to Part D claims data and is limited to
the original 37 elements
[[Page 30681]]
reported on the PDE record; to add a reference to pilot projects, and
to add care coordination and disease management activities, quality
improvement and performance measurement activities, and the populating
of personal health records to the list of necessary and appropriate
purposes for the collection of this information. This list is not
intended to be exclusive, and Part D claims data may be collected for
other purposes that the Secretary deems necessary and appropriate.
++ Removing paragraph (f)(5) and incorporating the provisions of
this paragraph in paragraphs (l) and (m).
++ Adding a new paragraph (l) to specify that CMS may use the data
collected under Sec. 423.505(f)(3).
++ Adding a new paragraph (m) to specify that CMS may release the
minimum data collected under Sec. 423.505(f)(3) in accordance with
applicable Federal laws, our established data sharing procedures, and
subject to encryption of certain identifiers and aggregation of cost
data to protect beneficiary confidentiality and commercially sensitive
data of Part D sponsors.
IV. Collection of Information Requirements
Under the Paperwork Reduction Act of 1995, we are required to
provide 30-day notice in the Federal Register and solicit public
comment before a collection of information requirement is submitted to
the Office of Management and Budget (OMB) for review and approval. In
order to fairly evaluate whether an information collection should be
approved by OMB, section 3506(c)(2)(A) of the Paperwork Reduction Act
of 1995 requires that we solicit comment on the following issues:
The need for the information collection and its usefulness
in carrying out the proper functions of our agency.
The accuracy of our estimate of the information collection
burden.
The quality, utility, and clarity of the information to be
collected.
Recommendations to minimize the information collection
burden on the affected public, including automated collection
techniques.
This document does not impose new information collection
requirements on Medicare Part D plans. Medicare Part D plan sponsors
already submit the information required to conduct the studies
discussed earlier in the preamble of this document. Medicare Advantage
prescription drug plan (MA-PD) sponsors, prescription drug plan (PDP)
sponsors, and Fallback plan sponsors, as required by the MMA, are
required to submit payment-related data to CMS that include, but are
not limited to, Part D claims data. The information collection
requirements associated with the collection of prescription drug data
from MA-PD, PDP and Fallback plan sponsors for Medicare Part D payments
are currently approved under the Office of Management and Budget (OMB)
Control No. 0938-0982, with an expiration date of November 30, 2009.
Additionally, we have included a discussion of the currently approved
information collection requirements associated with the Medicare Part D
reporting requirements and the plan benefit package (PBP) and formulary
submission for Medicare Advantage prescription drug plans (MA-PD) and
prescription drug plans (PDPs). The information collection requirements
(ICRs) for the Part D reporting requirements and the plan benefit
package are approved under OMB Control Nos. 0938-0992 and 0938-0763,
respectively.
A. ICRs Regarding Contract Provisions (Sec. 423.505)
Section 423.505 discusses provisions that must be contained in
contracts between Part D plan sponsors and CMS. Specifically, Sec.
423.505(b)(8) requires that a Part D plan sponsor comply with the
disclosure and reporting requirements in Sec. 423.505(f), Sec.
423.514, and Sec. 423.329(b), respectively. Section 423.505(f) lists
the information that Part D plan sponsors are required to disclose to
CMS. This information includes but is not limited to the disclosure of
certified financial information, the disclosure of all information
necessary for us to administer and evaluate the program and to
simultaneously establish and facilitate a process for current and
prospective beneficiaries to exercise choice in obtaining prescription
drug coverage, and the disclosure to its enrollees of all informational
requirements under Sec. 423.128 and, upon an enrollee's request, the
financial disclosure information required under Sec. 423.128(c)(4).
B. ICRs Regarding Reporting Requirements (Sec. 423.514)
Section 423.514 outlines the reporting requirements for Part D plan
sponsors. Section 423.514(a) requires each Part D plan sponsor to have
an effective procedure to develop, compile, evaluate, and report to
CMS, to its enrollees, and to the general public, at the times and in
the manner that CMS requires. Section 423.514(b) requires Part D plan
sponsors to report to CMS annually, within 120 days of the end of its
fiscal year, significant business transactions. In addition, Sec.
423.514(c) sets forth the requirements for submitting combined
financial statements. For any employees' health benefits plan that
includes a Part D plan sponsor in its offerings, Sec. 423.514(d)
addresses the reporting and disclosure obligations under the Employee
Retirement Income Security Act of 1974 (ERISA). Section 423.514(e)
states that each Part D plan sponsor must notify CMS of any loans or
other special financial arrangements it makes with contractors,
subcontractors and related entities. Section 423.514(f) requires each
Part D plan sponsor to make the information reported to CMS under this
section available to its enrollees upon reasonable request.
C. ICRs Regarding Determination of Payments (Sec. 423.329)
Section 423.329(b) contains the reporting requirements for PDPs and
MA-PDs for the purposes of determining health status risk adjustment.
As stated in Sec. 423.329(b)(3)(i), PDPs are required to submit data
regarding drug claims that can be linked at the individual level to
Part A and Part B data in a form and manner similar to the process
provided under Sec. 422.310 of this chapter and other information as
we determine necessary. In addition, Sec. 423.329(b)(3)(ii) requires
MA organizations that offer MA-PD plans to submit data regarding drug
claims that can be linked at the individual level to other data that
the organizations are required to submit to CMS in a form and manner
similar to the process provided under Sec. 422.310 and other
information as we determine necessary.
D. ICRs Regarding Contract Provisions (Sec. 423.505(b)(8))
The burden associated with the requirements in Sec. 423.505(b)(8)
of this regulation is the time and effort associated with meeting the
aforementioned requirements in Sec. 423.505(f), Sec. 423.514, and
Sec. 423.329(b). As stated earlier, these requirements are subject to
the PRA; however, they are approved under existing OMB control numbers.
The requirements in Sec. 423.505(f) and Sec. 423.514 are currently
approved under OMB control number 0938-0992 with an expiration date of
June 30, 2008. The information collection requirements contained in
Sec. 423.329(b) are currently approved under OMB control number 0938-
0763, with an expiration date of November 30, 2009.
[[Page 30682]]
Table 1.--Estimated Annual Reporting and Recordkeeping Burden
----------------------------------------------------------------------------------------------------------------
Burden per Total annual
Regulation section OMB Control Number of Number of response burden
number respondents responses (hours) (hours)
----------------------------------------------------------------------------------------------------------------
Sec. 423.505 ** and Sec. 0938-0992 3,203 179,368 .69 123,764
423.514 **.....................
Sec. 423.329 **............... 0938-0763 430 4,515 2.29 **10,319
-------------------------------------------------------------------------------
Total....................... .............. .............. .............. .............. 138,469
----------------------------------------------------------------------------------------------------------------
** As specified by Sec. 426.505(b)(8)
As required by section 3504(h) of the Paperwork Reduction Act of
1995, we have submitted a copy of this document to the Office of
Management and Budget (OMB) for its review of these information
collection requirements.
V. Regulatory Impact Statement
We have examined the impact of this rule as required by Executive
Order 12866 (September 1993, Regulatory Planning and Review), the
Regulatory Flexibility Act (RFA) (September 19, 1980, Pub. L. 96-354),
section 1102(b) of the Social Security Act, the Unfunded Mandates
Reform Act of 1995 (Pub. L. 104-4), Executive Order 13132 on Federalism
and the Congressional Review Act (5 U.S.C. 804 (2)).
Executive Order 12866, as amended, directs agencies to assess all
costs and benefits of available regulatory alternatives and, if
regulation is necessary, to select regulatory approaches that maximize
net benefits (including potential economic, environmental, public
health and safety effects, distributive impacts, and equity). A
regulatory impact analysis (RIA) must be prepared for major rules with
economically significant effects ($100 million or more in any 1 year).
This final rule does not have economically significant effects of $100
million or more in any one year and therefore is not a major rule.
We assessed alternatives, including, not releasing data to any
entity meeting the applicable criteria. We determined that the approach
that maximizes public health benefits is the approach taken in the
final regulation, which would use a case-by-case evaluation approach
similar to the process in use today for Medicare Parts A and B data,
with some additional restrictions to protect privacy and commercially
sensitive data of Part D sponsors. Weighing all factors, this approach
limits the risk that sensitive Part D claims data will be released to
inappropriate entities leading to the inappropriate use of this
sensitive data, but maximizes the benefit that this data can provide in
supporting research studies and other actions that will benefit the
public.
We do not believe that new costs associated with compliance under
this regulation, if any, will be significant. As stated in section II.
E. of this final rule, we expect risk and compliance burdens to be
limited; therefore any costs associated with compliance or
inappropriate use of data are expected to be limited, and because the
use of these data according to applicable laws and CMS data release
policies is expected to improve the public's health, this rule does not
reach the economic threshold and thus is not considered a major rule
requiring a RIA.
The RFA requires agencies to analyze options for regulatory relief
of small businesses. For purposes of the RFA, small entities include
small businesses, nonprofit organizations, and small governmental
jurisdictions. Most hospitals and most other providers and suppliers
are small entities, either by nonprofit status or by having revenues of
$6 million to $29 million in any 1 year. Individuals and states are not
included in the definition of a small entity. While a number of Part D
plan sponsors are small entities due to their nonprofit status, few, if
any, of the Part D plan sponsors meet the size standard for a small
insurance firm by having revenues of $6 million or less in any 1 year.
Therefore, an analysis for the RFA will not be prepared because the
Secretary has determined that this final rule will not have a
significant economic impact on a substantial number of small entities.
Furthermore, we believe, the rule does not create a significant
economic impact on Part D plan sponsors.
In addition, section 1102(b) of the Act requires us to prepare a
regulatory impact analysis if a rule may have a significant impact on
the operations of a substantial number of small rural hospitals. This
analysis must conform to the provisions of section 604 of the RFA. An
analysis for section 1102(b) of the Act will not be prepared because
the Secretary has determined that this final rule will not have a
significant impact on the operations of a substantial number of small
rural hospitals. In fact, we do not expect that it will have any impact
on small rural hospitals because the rule relates to Part D plan
sponsors, not small rural hospitals.
Section 202 of the Unfunded Mandates Reform Act of 1995 also
requires that agencies assess anticipated costs and benefits before
issuing any rule whose mandates require spending in any 1 year of $100
million in 1995 dollars, updated annually for inflation. That threshold
level is currently approximately $130 million. This final rule will not
contain mandates having a negative effect on state, local, or tribal
governments in the aggregate, or by the private sector, of $130
million.
Executive Order 13132 establishes certain requirements that an
agency must meet when it promulgates a final rule that imposes
substantial direct requirement costs on state and local governments,
preempts State law, or otherwise has Federalism implications. Even
though states may incur costs associated with exchanging data, this
regulation does not require states to request Part D claims data, but
makes it an option, provided we can resolve any operational issues. In
fact, even if States do request data, they may already have systems in
place to receive data from CMS. Furthermore, we are not aware of any
conflict between this final regulation and State privacy laws (with
which Part D sponsors must comply per our regulations). Therefore, we
do not believe this final regulation will implicate a Federalism issue
through an impact on State privacy laws. Since this regulation does not
impose any costs on state or local governments, the requirements of
Executive Order 13132 are not applicable.
We received the following comments regarding the impact analysis of
the proposal rule:
Comment: One commenter stated that because of the monetary cost and
other compliance burdens associated with the implementation of this
regulation due to HIPAA, this rule, if implemented, must be implemented
at the beginning of a calendar year per Sec. 423.516.
Response: We address this comment in section II. E. of this final
rule.
Comment: A commenter stated that in determining whether the
rulemaking
[[Page 30683]]
met the $100 million threshold the value of the information to
beneficiaries should have been considered. The commenter states that
the value would surpass $100 million, since brokers rent lists
potentially for $5 million per rental, often several times a year.
Response: Under our data release policies, we would not allow the
release of Part D claims data for commercial purposes. Thus, we do not
believe the $100 million threshold would be met based on the example
cited by the commenter. It is unlikely that list brokers will receive
any nonpublic data from CMS.
In accordance with the provisions of Executive Order 12866, this
regulation was reviewed by the Office of Management and Budget.
List of Subjects in 42 CFR Part 423
Administrative practice and procedure, Medicare, Prescription
Drugs, Reporting and recordkeeping.
0
For the reasons set forth in the preamble, the Centers for Medicare &
Medicaid Services amends 42 CFR chapter IV as set forth below:
PART 423--VOLUNTARY MEDICARE PRESCRIPTION DRUG BENEFIT
0
1. The authority citation for part 423 is amended to read as follows:
Authority: Sections 1102, 1106, 1860D-1 through 1860D-42, and
1871 of the Social Security Act (42 U.S.C. 1302, 1306, 1395w-101
through 1395w-152, and 1395hh).
Subpart A--General Provisions
0
2. Section 423.1 is amended by adding a new reference to paragraph
(a)(1) in numerical order to read as follows:
Sec. 423.1 Basis and scope
(a) * * *.
(1) * * *.
1106. Disclosure of Information in Possession of Agency.
* * * * *
Subpart K--Application Procedures and Contracts With Part D Plan
Sponsors
0
3. Section 423.505 is amended by--
0
A. Revising paragraph (b)(8).
0
B. Redesignating paragraph (f)(3) as (f)(4).
0
C. Adding new paragraph (f)(3).
0
D. Adding new paragraphs (l) and (m).
The revisions and additions read as follows:
Sec. 423.505 Contract provisions.
* * * * *
(b) * * *
(8) Comply with the disclosure and reporting requirements in Sec.
423.505(f), Sec. 423.514, and the requirements in Sec. 423.329(b) of
this part for submitting current and prior drug claims and related
information to CMS for its use in risk adjustment calculations and for
the purposes of implementing Sec. 423.505(f), (l), and (m) and Sec.
423.329(b) of this part.
* * * * *
(f) * * *
(3) The 37 original data elements included in all of its drug
claims for purposes deemed necessary and appropriate by the Secretary,
including, but not limited to, the following:
(i) Reporting to Congress and the public on overall statistics
associated with the operation of the Medicare prescription drug
program.
(ii) Conducting evaluations of the overall Medicare program,
including the interaction between prescription drug coverage under Part
D of Title XVIII of the Social Security Act and the services and
utilization under Parts A, B, and C of title XVIII of the Act and under
titles XIX and XXI of the Act, as well as other studies addressing
public health questions.
(iii) Making legislative proposals to the Congress regarding
Federal health care programs and related programs.
(iv) Conducting demonstration and pilot projects and making
recommendations for improving the economy, efficiency, or effectiveness
of the Medicare program.
(v) Supporting care coordination and disease management programs,
(vi) Supporting quality improvement and performance measurement
activities, and;
(vii) Populating personal health care records.
* * * * *
(l) CMS may use the information collected under paragraph (f)(3) of
this section. Any restriction set forth by Sec. 423.322(b) of this
part must not be construed to limit the Secretary's authority to use
the information collected under paragraph (f)(3).
(m)(1) CMS may release the minimum data necessary for a given
purpose from the data collected under paragraph (f)(3) of this section
to Federal executive branch agencies, congressional oversight agencies,
States, and external entities in accordance with the following:
(i) Applicable Federal laws.
(ii) CMS data sharing procedures.
(iii) Subject, in certain cases, to encryption of certain
identifiers and aggregation of cost data to protect beneficiary
confidentiality and commercially sensitive data of Part D sponsors, in
accordance with all of the following principles:
(A) Subject to the restrictions in this paragraph, all elements on
the claim are available to congressional oversight agencies (as defined
in paragraph (m)(1)(iv) of this section) and HHS.
(B) Cost data elements on the claim generally are aggregated for
releases to other executive branch agencies, States, and external
entities.
(C) Plan identifier elements on the claim are encrypted or
unavailable for releases to external entities.
(D) Beneficiary, pharmacy, and prescriber identifier elements on
the claim generally are encrypted for releases to external entities,
except in limited circumstances, such as to link to another data set.
(iv) For purposes of paragraph (m)(1)(iii) of this section,
congressional oversight agencies (the Congressional Budget Office, the
Government Accountability Office, the Medicare Payment Advisory
Commission, and the Congressional Research Service when acting on
behalf of a congressional committee in accordance with 2 U.S.C.
166(d)(1)), States, and executive-branch Federal agencies are not
considered to be external entities.
(2) Any restriction set forth by Sec. 423.322(b) of this part must
not be construed to limit the Secretary's authority to release the
information collected under paragraph (f)(3) of this section.
(Catalog of Federal Domestic Assistance Program No. 93.773,
Medicare--Hospital Insurance; and Program No. 93.774, Medicare--
Supplementary Medical Insurance Program)
Dated: February 25, 2008.
Kerry Weems,
Acting Administrator, Centers for Medicare & Medicaid Services.
Approved: March 17, 2008.
Michael O. Leavitt,
Secretary.
The following appendix will not appear in the Code of Federal
Regulations.
Appendix--Data Element Availability Under Section 1860D-12 of the
Social Security Act by Type of Requestor
CMS and its contractors have access to all PDE elements. This chart
shows the data elements that are available for release to other federal
and state agencies and external entities in the final rule under our
minimum necessary data policy subject, in certain cases, to encryption
of certain identifiers and aggregation of cost data to protect
beneficiary confidentiality and commercially sensitive data of Part D
sponsors. Thus, a requestor would not automatically receive all of the
available elements, but would only receive those necessary for their
study. (Note: As
[[Page 30684]]
stated in the preamble to the final rule, this chart applies only when
data is collected under section 1860D-12 of the Act, and does not apply
to any uses or disclosures already permitted under section 1860D-15 of
the Act, including to carry out audits and evaluations necessary to
ensure accurate and correct payment and to otherwise oversee Medicare
reimbursement under Part D. These uses are already contemplated under
both the statute and the regulations at Sec. 423.322(b) and are not
the subjects of this final rule.)
----------------------------------------------------------------------------------------------------------------
Other (i.e., non-CMS)
DHHS entities, and Non-HHS Executive
Data elements Congressional Oversight Branch Agencies and External entities
Agencies* See Note 1 States
----------------------------------------------------------------------------------------------------------------
Identifiers
----------------------------------------------------------------------------------------------------------------
Encryption permits analysis on a beneficiary, plan, prescriber, or pharmacy level without disclosure of the
actual identifying information. CMS will link our data to other data files, to the extent feasible, to minimize
the extent to which other parties need identifiers for data linkage purposes. CMS has the sole authority to
determine whether a particular data element is needed for a request.
----------------------------------------------------------------------------------------------------------------
Beneficiary ID (HIC Number, Encrypted, but Encrypted, but Encrypted, but
Cardholder ID, Patient date of available if needed. available if needed. available if needed to
birth) See Note 2. link to another
dataset.
Plan ID (PBP identifier, Contract Encrypted, but Encrypted, but Encrypted.
identifier) See Note 3. available if needed. available if needed.
Additionally,
nonencrypted data will
be available for
purposes of
performance measures.
Prescriber ID (Prescriber Identifier) Encrypted, but Encrypted, but Encrypted, but
See Note 4. available if needed. available if needed. available if needed to
link to another
dataset.
Additionally,
nonencrypted data will
be available for
purposes of
performance measures.
Pharmacy ID (Service provider Encrypted, but Encrypted, but Encrypted, but
identifier) See Note 5. available if needed. available if needed. available if needed to
link to another
dataset.
Qualifying Identifiers (Service & Available.............. Available.............. Available.
Prescriber Identifier Qualifiers--
codes that denote whether NPI,
NCPDP, UPIN, state license number,
DEA, or non-standard code is used).
Internal plan/pharmacy prescription Available.............. Unavailable............ Unavailable.
identification numbers (Claim
Control Number--a code intended for
the plan to identify unique events &
Prescription Service Reference
Number--a code assigned by the
pharmacy at the time the
prescription is filled).
----------------------------------------------------------------------------------------------------------------
Drug Utilization Information
----------------------------------------------------------------------------------------------------------------
Date of Service...................... Available.............. Available.............. Available.
Drug information (Product/Service Available.............. Available.............. Available.
Identifier, Quantity Dispensed, Days
Supply, Compound Code, Fill Number,
Dispensing Status.).
Other utilization information Available.............. Available.............. Available.
(Dispense as Written/Product
Selection Code, Drug Coverage Status
Code).
----------------------------------------------------------------------------------------------------------------
Drug Cost Information
----------------------------------------------------------------------------------------------------------------
Total Drug Costs (Ingredient Cost, Available, Available, Aggregated.. Available, Aggregated.
Dispensing Fee, Total Amount Disaggregated.
Attributable to Sales Tax) See Note
6.
----------------------------------------------------------------------------------------------------------------
Coverage Information
----------------------------------------------------------------------------------------------------------------
Date Paid............................ Available.............. Available.............. Available.
Plan Paid Amounts (Covered D Plan Available.............. Available.............. Available.
Paid Amount, Non-covered Plan Paid
Amounts).
Beneficiary cost sharing (Patient Pay Available.............. Available.............. Available.
Amount,).
Other Payer Amounts (Other True Out Available.............. Available.............. Available.
of Pocket Amount, Patient Liability
due to Other Payer Amount).
Low-Income Subsidy Amount............ Available.............. Available.............. Available.
Other Financial Information (Gross Available.............. Available.............. Available.
Drug Cost below Out-of-pocket
Threshold, Gross Drug Cost above Out-
of-pocket Threshold).
----------------------------------------------------------------------------------------------------------------
Other Descriptive Data
----------------------------------------------------------------------------------------------------------------
Patient gender....................... Available.............. Available.............. Available.
[[Page 30685]]
Catastrophic Coverage Indicator Available.............. Available.............. Available.
(Catastrophic Coverage Code).
In-network versus OON or MSP claim Available.............. Available.............. Available.
(Pricing Exception code).
Electronic versus Paper Claim (Non- Available.............. Available.............. Available.
Standard format Code).
Original versus Adjusted PDE Available.............. Final Action claims Final Action claims
(Adjustment/Deletion code). would be provided, so would be provided, so
this element should this element should
not be needed. not be needed.
----------------------------------------------------------------------------------------------------------------
Generally, the notes apply to all columns across the row.
Note 1--Congressional oversight agencies include GAO, MedPAC, and CBO. CRS is considered a Congressional
oversight agency, but only when acting on behalf of a committee pursuant to its authority in 2 U.S.C. Sec.
166(d)(1). Otherwise, CRS is considered to be an external entity. Note also that OIG has authority independent
of both sections 1860D-12 and 1860D-15 of the Social Security Act to collect data.
Note 2--CMS will encrypt all beneficiary identifiers unless they are needed. An example of where they might be
needed is linkage to another dataset. When CMS sends real identifiers in order to permit the requestor to link
files, CMS will encrypt identifiers during transmission, provide a link key to unencrypt the files, allow the
linkage, and then require the requestor to re-encrypt identifiers. Public disclosure of research results will
not include beneficiary identifying information.
Note 3--In general, CMS will link the Part D claims to plan level benefits and formulary data if needed by the
requestor, and then encrypt the plan ID. However, CMS will not link certain information if it will lead to a
de facto identification of the plan. CMS may develop plan specific performance measures which are publicly
reported.
Note 4--CMS will link to physician characteristics from CMS files if needed by the requestor. Generally, when
CMS sends real identifiers in order to permit the requestor to link files, CMS will encrypt identifiers during
transmission, provide a link key to unencrypt the files, allow the linkage, and then require the requestor to
re-encrypt identifiers.
Note 5--To the extent available, CMS will provide pharmacy characteristics from CMS files. However, CMS will not
release pharmacy ID, together with drug cost information, in order to guard against the disclosure of
negotiated price information.
Note 6--Generally, CMS will aggregate ingredient cost, dispensing fee, and sales tax at the individual claim
level. Upon request, CMS will exclude sales tax from the aggregation at the individual claim level if
necessary for the project.
[FR Doc. 08-1298 Filed 5-22-08; 1:30 pm]
BILLING CODE 4120-01-P