MEDICARE PART D DATA REGULATION (CMS-4119-F)

CMS issued a final rule today to permit Part D claims data to be used for program monitoring, research, public health, care coordination, quality improvement, population of personal health records, and other purposes.  To address concerns raised in the rulemaking process, CMS has balanced access to the data with protections for beneficiary privacy and commercially-sensitive plan data to safeguard public health and permit broader public knowledge about the operations of the Part D program.  Under the final rule, CMS may release the Part D claims data to other Federal government agencies, States, external researchers, and beneficiaries for their personal health records.

Background on this rulemaking

In order to permit the use and release of Part D claims data for these additional purposes, CMS issued a proposed rule in October of 2006 requesting comment on its proposal to treat Part D claims data in a manner similar to Medicare Parts A and B claims data.  Furthermore, CMS invited the public to comment on whether the agency should consider any additional protections for beneficiary privacy and/or Part D plan commercially-sensitive data.

CMS received numerous comments on the proposed rule’s permitting access to the Part D claims data. Some commenters underscored the need for beneficiary privacy to be protected.  Commenters also expressed concerns regarding the potential impact on Part D costs for taxpayers and beneficiaries if commercially-sensitive plan data were to be publicly released. 

Protections for beneficiary privacy and commercially-sensitive plan data

To address these concerns, CMS has balanced access to the data to safeguard public health and permit broader public knowledge about the operations of the Part D program, with new protections for beneficiary privacy and commercially-sensitive plan information.  CMS builds upon its current data release process for Medicare Parts A and B claims data and adds additional protections:

• First, CMS will not release beneficiary, prescriber, or pharmacy identifiers to other government agencies or external researchers unless these are absolutely necessary for the study, such as to link to another database.  Where identifiers are disclosed to external researchers, CMS will ensure that all applicable privacy and security protections are in place, such as ensuring that all electronic transmissions are encrypted.

• Second, to protect commercially-sensitive plan data, this final rule addresses only 37 elements of Part D claims data and does not extend to Part D plan-specific bid data, rebates, risk-sharing, reinsurance, or payment information collected outside of a Part D claim. 
• Third, when released to external researchers, Part D plan identifiers will be encrypted and cost data elements will be aggregated. To do otherwise could negatively affect the ability of plans to negotiate prices favorable to beneficiaries and taxpayers. 

CMS requires external researchers to sign a Data Use Agreement (DUA) that outlines certain restrictions placed on the data, including a requirement that once a project is completed, the data must be destroyed and no copies can be retained. 

Access to the Part D claims data

CMS will provide drug claims information collected under this final rule to other federal agencies, States, and researchers through a process that builds upon the safeguards that exist today for other Medicare data, such as:

• Providing only the minimum data necessary to complete the study;
• Requiring that the results of the research (if applicable) be in the public domain; and
• If an external entity, requiring that the researcher have the requisite experience and be working in a reputable institution.

The study of Part D claims linked to Medicare Parts A and B claims will allow the benefits and risks of drug treatment for the elderly and disabled to be studied directly on a national database, the size and scope of which will permit numerous studies that, to-date, have not been possible.  In 2008, more than 25 million Medicare beneficiaries are enrolled in Part D plans for which Medicare will receive about 1 billion claims annually.  These data, when linked to other Medicare claims for hospitalizations and physician services, are a rich source of information about patterns of drug treatment, health outcomes, and adverse events among the elderly and disabled.  CMS does not have drug claims for Medicare beneficiaries who receive their drug coverage from other sources such as employer sponsored plans, the VA, FEHBP or TRICARE.

HHS agencies including the FDA, NIH, and AHRQ, will use the Part D claims data in their research studies.  States have requested Part D claims data for their Medicaid and Medicare dual eligible beneficiaries to support care coordination and disease management.  The data may also be used for populating personal health records for beneficiaries.  External researchers at think tanks and universities, for example, may use the Part D claims data in their research projects.  CMS will not release beneficiary identifiable Part D claims data for commercial purposes.

Why this rule is important for the health of Medicare beneficiaries

To date, CMS’s understanding of how well drugs work and how safe they are for the elderly or disabled has been limited.  Clinical trials often exclude the very old, patients with multiple chronic conditions, and those taking multiple medications, comprising the vast majority of Medicare beneficiaries.  These data will provide a critical new source of information about how these drugs work and their safety in the elderly and disabled populations.

Medicare beneficiaries have an average of 28 prescriptions in a year, while those beneficiaries who describe themselves to be in poor health have 45 prescriptions in a year, putting them at higher risk of adverse drug events than other Americans[1].  Americans under the age of 65 use about half as many drugs as Medicare beneficiaries -- at about 13 prescriptions per year.[2]

In its report Preventing Medication Errors, the Institute of Medicine (IOM) estimated that 1.5 million preventable adverse drug events (ADEs) occur each year in the United States. A study reported in the Journal of the American Medical Association found that about 530,000 preventable ADEs occur each year among outpatient Medicare beneficiaries[3]. The cost of treating preventable ADEs in Medicare enrollees alone is approximately $887 million a year.   CMS anticipates that research using the new Medicare claims database will lead to fewer adverse drug events over time.

For more information

CMS will be developing guidelines and workshops to inform researchers on how they can access this new database.  Additional information is available from our research data assistance center at:  http://www.resdac.umn.edu/.

An open door forum will be conducted in June 2008 to review the final rule, discuss the Part D claims data release process, and answer questions from the public.  To participate in the open door forum, please review www.cms.hhs.gov/opendoorforums

Data Element Availability Under Section 1860D-12 of the Social Security Act

by Type of Requestor

CMS and its contractors have access to all PDE elements.  The chart below shows the data elements that are available for release to other federal and state agencies and external entities in the final rule under CMS’s minimum necessary data policy, subject, in certain cases, to encryption of certain identifiers and aggregation of cost data to protect beneficiary confidentiality and commercially sensitive data of Part D sponsors. Thus, a requestor would not automatically receive all of the available elements, but would only receive those necessary for their study.  (Note: As stated in the preamble to the final rule, this chart applies only when data is collected under section 1860D-12 of the Act, and does not apply to any uses or disclosures already permitted under section 1860D‑15 of the Act, including to carry out audits and evaluations necessary to ensure accurate and correct payment and to otherwise oversee Medicare reimbursement under Part D.  These uses are already contemplated under both the statute and the regulations at §423.322(b) and are not the subjects of this final rule.)

Generally, the notes apply to all columns across the row.

Note 1 – Congressional oversight agencies include GAO, MedPAC, and CBO.  The Congressional Research Service (CRS) is considered a Congressional oversight agency, but only when acting on behalf of a committee pursuant to its authority in 2 U.S.C. § 166(d)(1).  Otherwise, CRS is considered to be an external entity. Note also that OIG has authority independent of both sections 1860D-12 and 1860D-15 of the Social Security Act to collect data.

Note 2 - CMS will encrypt all beneficiary identifiers unless they are needed.  An example of where they might be needed is linkage to another dataset.  When CMS sends real identifiers in order to permit the requestor to link files, CMS will encrypt identifiers during transmission, provide a link key to unencrypt the files, allow the linkage, and then require the requestor to re-encrypt identifiers. Public disclosure of research results will not include beneficiary identifying information.

Note 3 –In general, CMS will link the Part D claims to plan level benefits and formulary data if needed by the requestor, and then encrypt the plan ID.  However, CMS will not link certain information if it will lead to a de facto identification of the plan.  CMS may develop plan specific performance measures which are publicly reported.

Note 4 - CMS will link to physician characteristics from CMS files if needed by the requestor.  Generally, when CMS sends real identifiers in order to permit the requestor to link files, CMS will encrypt identifiers during transmission, provide a link key to unencrypt the files, allow the linkage, and then require the requestor to re-encrypt identifiers.

Note 5– To the extent available, CMS will provide pharmacy characteristics from CMS files.   However, CMS will not release pharmacy ID, together with drug cost information, in order to guard against the disclosure of negotiated price information.    

Note 6 – Generally, CMS will aggregate ingredient cost, dispensing fee, and sales tax at the individual claim level.  Upon request, CMS will exclude sales tax from the aggregation at the individual claim level if necessary for the project.