129 CMR 3.00 — Disclosure of health care claims data

129 CMR: HEALTH CARE QUALITY AND COST COUNCIL

129 CMR 3.00: DISCLOSURE OF HEALTH CARE CLAIMS DATA

Section

3.01: General Provisions 3.02: Definitions 3.03: Data Release Review Board and Review Procedures 3.04: Data Disclosure and Use Restrictions 3.05: Other Provisions 3.06: Severability

129 CMR 3.00 Disclosure of health care claims data

3.01 General Provisions

3.01: General Provisions

(1) Authority . 129 CMR 3.00 is promulgated under the authority of and in conformity with M.G.L. c. 6A, §§16J, 16K and 16L.

(2) Scope and Purpose . 129 CMR 3.00 governs the disclosure of Health Care Claims Data submitted by carriers and third-party administrators to the Health Care Quality and Cost Council pursuant to 129 CMR 2.00. The purpose of 129 CMR 3.00 is to protect the privacy of data subjects and the confidentiality of health care claims data while permitting limited access to such data where such access serves the public interest. Pursuant to M.G.L. c. 6A, § 16K(f), all data collected by the Council is not a public record, and no public disclosure of any data shall be made except in accordance with M.G.L. c. 6A, § 16K and 129 CMR 3.00.

(3) Effective Date . 129 CMR 3.00 is effective on January 8, 2010.

3.02 Definitions

3.02: Definitions

The following words shall have the following meanings:

Applicant. An individual, group of individuals, or organization which formally requests the release of Health Care Claims Data in accordance with 129 CMR 3.03.

Board . The Council’s Data Release Review Board established pursuant to 129 CMR 3.03.

Carrier . Any entity subject to the insurance laws and rules of Massachusetts, or subject to the jurisdiction of the commissioner of insurance that contracts or offers to provide, deliver, arrange for, pay for, or reimburse any of the costs of health services, and includes an insurance company, a health maintenance organization, a nonprofit hospital services corporation, a medical service corporation, third-party administrator or any other entity arranging for or providing insured health coverage.

CMS. The federal Centers for Medicare and Medicaid Services.

Council. The Health Care Quality and Cost Council established under M.G.L. c. 6A, § 16K.

Data Use Agreement . A document detailing restrictions on the disclosure and use of Health Care Claims Data.

Disclosure . The release, transfer, provision of, access to, or divulging in any other manner of information outside the entity holding the information.

Encryption . The use of an algorithmic process to transform data into a form in which there is a low probability of assigning meaning without use of a confidential process or key.

Health Care Claims Data . Information consisting of, or derived directly from, member eligibility information, medical claims, pharmacy claims, and all other data submitted by health care claims processors pursuant to 129 CMR 2.00.

Health Care Claims Processor. A third-party payer, third-party administrator, or carrier that provides administrative services for a plan sponsor.

1/8/10 129 CMR - 65

129 CMR: HEALTH CARE QUALITY AND COST COUNCIL

3.02 continued

3.02: continued

Provider . A health care practitioner, health care facility, health care group, medical product vendor or pharmacy.

Public Use File . A health care data set which contains a selected number of variables as specified in 129 CMR 3.03(1).

Third-party Administrator. Any person or entity that, on behalf of a plan sponsor, health care services plan, nonprofit hospital or medical service organization, health maintenance organization or insurer, receives or collects charges, contributions or premiums for, or adjusts or settles claims on behalf of the residents of the state.

Third-party Payer . A health insurer, nonprofit hospital or medical services organization, or managed care organization or any other entity licensed in the Commonwealth of Massachusetts that pays for health care services or products.

3.03 Data Release Review Boar

3.03: Data Release Review Boar d and Review Procedures

(1) Public Use Files . The Council shall create three public use files of the Health Care Claims Data, including the Member Eligibility (ME) data, Medical Claims (MC) data, and Pharmacy Claims (PC) data.

(a) Level 1 . The Level 1 file includes the following Data Elements:

Data Element # Data Element Name

ME003 Insurance Type ME004 Year of Reported Eligibility ME005 Month of Reported Eligibility ME007 Coverage Level Code ME012 Individual Relationship Code ME013 Member Gender ME016 Member State or Province ME018 Medical Coverage -Yes/No ME019 Prescription Drug Coverage -Yes/No ME020 Race 1 ME021 Race 2 ME022 Other Race ME023 Hispanic Indicator -Yes/No ME024 Ethnicity 1 ME025 Ethnicity 2 ME026 Other Ethnicity MC003 Insurance Type/Product Code MC011 Individual Relationship Code MC012 Member Gender MC019 Admission Hour MC020 Admission Type MC021 Admission Source MC022 Discharge Hour MC023 Discharge Status Length of Stay (LOS) MC027 Service Provider Entity Type Qualifier MC031 Service Provider Suffix MC034 Service Provider State MC035A Service Provider Country Name MC036 Type of Bill -on Facility Claims MC037 Site of Service -on NSF/CMS 1500 Claims MC038 Claim Status MC039 Admitting Diagnosis MC040 E-Code MC041 Principal Diagnosis

1/8/10 129 CMR - 66

129 CMR: HEALTH CARE QUALITY AND COST COUNCIL

3.03 continued

3.03: continued

Data Element # Data Element Name (continued)

MC042 Other Diagnosis -1 MC043 Other Diagnosis -2 MC044 Other Diagnosis -3 MC045 Other Diagnosis -4 MC046 Other Diagnosis -5 MC047 Other Diagnosis -6 MC048 Other Diagnosis -7 MC049 Other Diagnosis -8 MC050 Other Diagnosis -9 MC051 Other Diagnosis -10 MC052 Other Diagnosis -11 MC053 Other Diagnosis -12 MC054 Revenue Code MC055 Procedure 1 Code MC056 Procedure 1 Modifier- 1 MC057 Procedure 1 Modifier -2 MC058 ICD-9-CM Procedure 1 Code MC061 Quantity MC065 Copay Amount MC067 Deductible Amount PC003 Insurance Type/Product Code PC011 Individual Relationship Code PC012 Member Gender PC017 Date Service Approved (AP Date) PC024A Pharmacy Country Name PC025 Claim Status PC026 Drug Code PC027 Drug Name PC028 New Prescription PC028A Refill Number PC029 Generic Drug Indicator PC030 Dispense as Written Code PC031 Compound Drug Indicator PC033 Quantity Dispensed PC034 Days Supply PC037 Average Wholesale Price (AWP) PC038 Postage Amount Claimed PC039 Dispensing Fee PC040 Copay Amount PC042 Deductible Amount

(b) Level 2 . The Level 2 file includes all the data elements in Level 1 plus the following data elements:

Data Element # Data Element Name

ME001 Payer ME002 National Plan ID ME008 Encrypted Subscriber Unique Identification Number ME009 Plan Specific Contract Number ME010 Member Suffice or Sequence Number ME011 Member Identification Code Member Age in Years Member Age in Months ME015 Member City Name ME017 Member ZIP Code

1/8/10 129 CMR-67

129 CMR: HEALTH CARE QUALITY AND COST COUNCIL

3.03 continued

3.03: continued

Data Element # Data Element Name (continued)

MC001 Payer MC002 National Plan ID MC004 Payer Claim Control Number MC005 Line Counter MC005A Version Number MC007 Encrypted Subscriber Unique Identification Number MC008 Plan Specific Contract Number MC009 Member Suffix or Sequence Number MC010 Member Identification Code MC014 Member City Name MC015 Member State or Province MC016 Member ZIP Code MC017 Date Service Approved (AP Date) MC018 Admission Date MC022A Discharge Date Member Age in Years at Discharge Member Age in Months at Discharge MC024 Service Provider Number MC025 Service Provider Tax ID Number MC026 National Service Provider ID MC028 Service Provider First Name MC029 Service Provider Middle Name MC030 Service Provider Last Name or Organization Name MC032 Service Provider Specialty MC033 Service Provider City Name MC035 Service Provider ZIP Code MC059 Date of Service -From MC060 Date of Service -Thru MC062 Charge Amount MC063 Paid Amount MC064 Prepaid Amount MC066 Coinsurance Amount

(c) Level 3. The Level 3 file includes all the data elements in Level 2 plus the following data elements:

Data Element # Data Element Name

ME006 Insured Group or Policy Number ME014 Member Date of Birth MC006 Insured Group or Policy Number MC013 Member Date of Birth PC006 Insured Group Number PC013 Member Date of Birth

(2) Data Release Review Board . The Council shall designate a Data Release Review Board to review applications for Health Care Claims Data filed pursuant to M.G.L. c. 6A, § 16K. (a) Members . The Board shall include at least one member of the Councilor Council member's designee; one member of the Council's Advisory Committee (established pursuant to M.G.L. c. 6A, § 16L); an attorney with expertise in health data privacy issues; a data security expert; a representative of a hospital licensed in Massachusetts; a clinician licensed to practice in Massachusetts; and any other individual whom both the Councilor designated Council staff deem necessary for the review and evaluation of applications for Health Care Claims Data. The Board shall include at least one person who has expertise using statistics, clinical data, demographic data, and payment data.

1/8/10 129 CMR - 68

129 CMR: HEALTH CARE QUALITY AND COST COUNCIL

3.03 continued

3.03: continued

(b) Terms . Members of the Board shall be appointed to serve for two years, but may be removed by a vote of the majority of the Council. (c) Administration . Under the Board's direction and authority, Council staff shall:

1. develop standard application materials;
2. review all applications for Health Care Claims Data;
3. ensure that all applications for Health Care Claims Data are complete;
4. process and approve applications for Level 1 Data Elements that meet the requirements of 129 CMR 3.03 through 3.05 and that do not involve any Level 2 data elements;
5. refer to the Board for review all applications for Level 2 Data Elements and any other applications that the Administrative Director or Council staff deem appropriate for the Board's review;
6. reject all applications for Level 3 Data, except those applications received from state agencies pursuant to 129 CMR 3.03(4);
7. refer all applications for Level 3 Data received from state agencies to the Board for review and action by the Board; and
8. prepare materials for presentation to the Board. (d) Meetings . The Board shall meet regularly according to a schedule set by the Council to review applications for Level 2 and Level 3 Data Elements and to review applications for any other Health Care Claims Data that Council staff deems appropriate for the Board's review. (e) Criteria for Release of Data . The Board will review the proposed use of the data, the credentials of the applicant, and the nature of the data requested. The Board shall, at a minimum, consider the following factors:
9. whether the proposed use of the data will jeopardize patient privacy;
10. whether the proposed disclosure may enable collusion or anti-competitive conduct;
11. the effect of the proposed use on the quality and costs of health care; and
12. whether the proposed use will further the public interest by promoting improvements in health care quality or reductions in the growth of health care costs.

(3) Application Review Procedures . (a) Applications for Data . All data applicants requesting access to, disclosure of, or use of Health Care Claims Data shall submit a written application using a form approved by the Council. In accordance with 129 CMR 3.03(3), only state agencies may apply for Level 3 Data. (b) Application Requirements . All applicants shall:

1. specify the purpose and intended use of the data requested, including a detailed project description;
2. specify each data field requested;
3. justify the need for each requested Level 2 Data Element to accomplish the applicant's stated purpose;
4. specify the applicant's qualifications to perform such research or accomplish the intended use;
5. specify administrative, security and privacy measures to be taken to safeguard the confidentiality of patient information, payment rates, and any Level 2 and Level 3 Data Elements that the Board permits to be released, and to prevent unauthorized access to or use of such data;
6. specify the applicant's methodology for maintaining data integrity and accuracy;
7. identify all employees who will have access to the requested Health Care Claims Data, and describe the activities they will conduct with the data and their qualifications to conduct those activities;
8. specify whether the applicant intends to engage an agent or contractor to conduct any function with the requested data and if so, identify such functions, describe the agent's or contractor's qualifications, state whether the agent or contractor will have access to the data at a location other than the applicant's location or in an off-site server and/or database, and specify all data security measures to be instituted with such agent or contractor;

1/8/10 129 CMR - 69

129 CMR: HEALTH CARE QUALITY AND COST COUNCIL

3.03 continued

3.03: continued

9. specify measures the applicant, his/her employees, and his/her agents will take to return the original released data to the Council at the conclusion of the applicant's use and to destroy all copies of the data remaining in the applicant's, his/her employee's and his/her agent's possession or control;
10. specify research protocols, as applicable;
11. specify whether the data will be linked to or used in conjunction with other data sources and if so, identify such data sources and explain the purpose for such linking and whether such linking would enable re-identification of the requested data elements;
12. specify the applicant's plans to publish or otherwise disclose any Level 1, Level 2 and Level 3 Data Elements, or any data derived or extracted from such data, in any paper, report, website, statistical tabulation, or similar document; and
13. agree to pay the application fee or request a waiver of the fee. (c) Criteria for Approval . The Board may approve for release to an applicant only the requested Health Care Claims Data that the Board determines is necessary to accomplish the applicant's purpose and intended use. Factors the Board may consider in determining whether to exercise its discretion to approve an application for Health Care Claims Data include, but are not limited to, the following:
14. the purpose for which the data is requested is in the public interest and is consistent with the mission and goals of the Council. Uses that serve the Council's mission and the public interest include, but are not limited to: health cost, quality and utilization analyses to formulate public policy; financial studies and analysis of hospital payment systems; utilization review studies; studies to develop indicators of quality of care and to identify areas for improvement; health care facility merger analyses; health planning and resource allocation studies; epidemiological studies, including the identification of morbidity and mortality patterns, and studies of prevalence and incidence of diseases; and research studies and investigation of other health care issues;
15. the applicant has demonstrated it is qualified to undertake the study or accomplish the intended use;
16. the applicant requires such data in order to undertake the study or accomplish the intended use;
17. the applicant can ensure that patient privacy will be protected;
18. the applicant can ensure that the identities of clinicians will be kept confidential;
19. the applicant can ensure that individual payment rates will be kept confidential;
20. the applicant can safeguard against unauthorized use and disclosure;
21. the applicant signs a Data Use Agreement that sets forth its agreement to comply with data release restrictions, prohibitions, and protections for the Council's Data; and
22. the applicant requires that any staff or agent that will have access to or process the data on the applicant's behalf agrees to follow all data restrictions, prohibitions, and protections set forth in 129 CMR 3.00 and the Data Use Agreement.

(4) Data Release Procedures .

(a) The Council shall establish a regular schedule for submission of applications and for review by the Board. The schedule shall provide that the Board will make reasonable efforts to notify each applicant of the Board's decision within 45 days of the scheduled application submission date. (b) The Board shall authorize access to data containing the fewest number of Data Elements necessary to accomplish the applicant's purpose or intended use. Similarly, if the Board determines that not all of the elements the applicant has requested are consistent with the applicant's intended use and purpose or with the mission and goals of the Council, or that release of certain requested elements may jeopardize patient privacy , or may enable collusion or anti-competitive conduct or may involve a likelihood of increasing health care costs, the Board may authorize the release of only those Data Elements that the Board deems consistent with the applicant's purpose and intended use or the Council's mission and goals or the release of which will not jeopardize patient privacy, enable collusion or anti-competitive conduct, or involve a likelihood of increasing health care costs.

1/8/10 129 CMR - 70

129 CMR: HEALTH CARE QUALITY AND COST COUNCIL

3.03 continued

3.03: continued

(c) If the application is incomplete or if the Board determines that supplemental information is needed to make its decision, the Board may require such supplemental information and notify the applicant accordingly. The Board's request for supplemental information from the applicant will trigger a new 45-day notification period (as set forth 129 CMR 3.03(2)(a)): a new 45-day notification period will begin to run on the date the applicant must provide the supplemental information to the Board (the date to be determined by the Board) or the date the applicant in fact provides the supplemental information to the Board, whichever is later. (d) If the Board denies an application for data in whole or in part, the Board will notify the applicant of the reason for denial. (e) An applicant may resubmit his or her application to address the concerns raised by the Board in its decision. The Board may reconsider a determination made under 129 CMR 3.03 based on new information or any other reasonable cause. (f) An applicant may appeal the denial of any application for data release by the Board to the Council. Such appeal must be filed within 30 days of the Board's decision and must specify the reason(s) that the applicant considers the Board's decision to be in error.

(4) Data Release to State Agencies . The Council may release to state agencies Level 1 and Level 2 data for uses that promote the public interest; and Level 3 data as authorized by M.G.L. c. 6A, § 16K. (a) Except as provided in 129 CMR 3.03(4)(e), a state agency must submit an application to the Data Release Review Board for data in compliance with the requirements of 129 CMR 3.02(b). (b) Each agency shall enter into an interagency service agreement with the Council that allows for specifically approved purposes and uses within the public interest, provides for security and measures to safeguard the confidentiality of patient information, fulfills the applicable requirements set forth in 129 CMR 3.03(2)(b) and (c), and makes the required assurances set forth in 129 CMR 3.04(1). (d) After an agency's initial request has been approved by the Board and an interagency service agreement has been executed, the Council may expedite subsequent data requests through a streamlined review process for additional agency projects or uses not stated in the original request. (e) The Council will provide state agencies with public use files free of charge. The Council may charge a state agency that requests custom programming of the Council's datasets the actual cost incurred to fulfill the request. The Council will notify the agency of the estimated cost prior to fulfilling the request. (f) Level 3 Data .

1. The Council may release Level 3 data to state agencies for purposes that promote the public interest as determined by the Council.
2. The Council shall provide the Division of Health Care Finance and Policy with the Level 3 Health Care Claims Data in accordance with the provisions of M.G.L. c. 6A, § 16K under an interagency service agreement for the purpose of conducting data analysis, preparing reports to assist in the formulation of health care policy and the provisions and purchase of health care services, and reviewing and evaluating mandated benefit proposals as required by M.G.L. c. 3, § 38C.

3.04 Data Disclosure and Use Restrictions

3.04: Data Disclosure and Use Restrictions

(1) Required Assurances . All applicants shall make the following written assurances in order to receive Health Care Claims Data from the Council: (a) The applicant, his/her employees, and his/her agents or contractors shall use the Health Care Claims Data only for the purpose stated in the request. (b) The applicant shall limit access to the Health Care Claims Data to authorized employees, agents, or contractors as are reasonably necessary to undertake the permitted data uses, and shall ensure that all such employees, agents, and contractors with access to the data comply with all data privacy and security protections and data use restrictions, prohibitions and protections set forth in 129 CMR 3.00 and in the Data Use Agreement with the Council. To that end, the applicant shall obtain the written assurances of any authorized agent or contractor to comply with data privacy and security protections and data use restrictions, prohibitions and protections set forth in 129 CMR 3.00 and in the Data Use Agreement, including reporting to the applicant any use or disclosure of Health Care Claims Data that is not provided for in the Data Use Agreement.

1/8/10 129 CMR - 71

129 CMR: HEALTH CARE QUALITY AND COST COUNCIL

3.04 continued

3.04: continued

(c) The applicant, his/her employees, and his/her agents or contractors shall not use the Health Care Claims Data, alone or in combination with any other data, to identify individual patients, clinicians or payment rates, nor will the applicant, his/her employees, and his/her agents or contractors attempt to identify individual patients, clinicians, or payment rates from the data, or to contact individual patients or clinicians. (d) The applicant, his/her employees, and his/her agents or contractors shall not use the Health Care Claims Data, alone or in combination with any other data, in ways that enable or permit collusion or anti-competitive conduct. (e) The applicant, his/her employees, and his/her agents or contractors shall not sell the Health Care Claims Data, nor use the data for any marketing or commercial purposes. (f) The applicant, his/her employees, and his/her agents or contractors shall retain the requested Health Care Claims Data only as long as is necessary to accomplish the applicant's intended use or purpose. The applicant, his/her employees, and his/her agents or contractors shall return to the Councilor destroy, in the Board's discretion, all such data, including any copies of the data, as soon as he/she has accomplished that purpose or use. The Board may limit the amount of time within which an applicant may retain data. (g) The applicant, his/her employees, and his/her agents or contractors shall not reuse, manipulate, or re-aggregate Health Care Claims Data for purposes other than those approved by the Board. (h) The applicant shall immediately report to the Board any use or disclosure of Health Care Claims Data that is not provided for in the Data Use Agreement and shall immediately attempt to retrieve such data and take other appropriate actions to limit the known harmful consequences of the non- permitted use of disclosure. (i) The applicant, his/her employees, and his/her agents shall permit the Council, its employees, and its designated agents to audit the applicant's compliance with the requirements of the Data Use Agreement at any time. The applicant shall provide any other assurances required by the Data Use Agreement.

(2) Publication . An applicant shall not publish or otherwise disclose any Level 1, Level 2 or Level 3 Data Elements, or any data derived or extracted from such data, in any paper, report, website, statistical tabulation, or similar document unless such paper, report, website, statistical tabulation, or similar document without prior review and approval of the Board. An Applicant must submit a copy of the proposed report or document to the Board for approval at a scheduled Board meeting at least 14 days before the meeting. The report must conform to the standards for de-identification set forth under 45 CFR 165.514(a), (b)(2), and (c). An applicant's public paper, report, website, statistical tabulation, or similar document may not contain individual payment rates, report any data on ten or fewer individuals or data derived from ten or fewer claims, or include any other matter that the Board has precluded for release in the Data Use Agreement.

3.05 Other Provisions

3.05: Other Provisions

(1) Nothing in 129 CMR 3.00 shall be construed to limit the Council from releasing information through the website as contemplated in M.G.L. c. 6A, § 16k.

(2) Nothing in 129 CMR 3.00 shall be construed to limit the Council from disclosing health care claims data to a Provider as permitted by M.G.L. 6A, § 16k and 129 CMR 4.00.

(3) The Council shall not release data sets that are materially incomplete or that failed to meet data quality standards delineated in the Statistical Plan established pursuant to 129 CMR 2.08.

(4) The Council shall charge a non-refundable fee, as approved by the Executive Office for Administration and Finance, to all applicants for data released by the Council that is not otherwise posted on the Council's website for public use. The chairperson of the Councilor designated Council staff may waive the fee only if the applicant can demonstrate that imposition of a fee would constitute a hardship.

(5) Sanctions. The Councilor the Board may impose the following sanctions if an approved applicant fails to comply with any of the data restrictions, prohibitions, protections and conditions specified in the Data Use Agreement:

1/8/10 129 CMR - 72

129 CMR: HEALTH CARE QUALITY AND COST COUNCIL

3.05 continued

3.05: continued

(a) deny access to any and all data in the future; (b) terminate current access to data; and (c) demand and secure the return of all data. Such applicants may also be subject to applicable statutory sanctions.

(6) Administrative Bulletins . The Council may issue administrative bulletins to clarify substantive provisions of 129 CMR 3.00 and to establish administrative procedures for processing applications, including timelines and information and documentation that must be submitted to process applications for data.

3.06 Severability

3.06: Severability

The provisions of 129 CMR 3.00 are severable and if any such provisions or the application of such provisions to any applicant or circumstances are held invalid or unconstitutional, such invalidity or unconstitutionality shall not be construed to affect the validity or unconstitutionality of any of the remaining provisions of 129 CMR 3.00 or of such provisions to an applicant or circumstances other than those as to which it is held invalid.

REGULATORY AUTHORITY

129 CMR 3.00: M.G.L. c. 6A, §§ 161, l6K and 16L.

1/8/10 129 CMR - 73