957 CMR 5.00 — Health Care Claims, Case Mix and Charge Data Release Procedures (PDF)

Adopted Regulation Effective February 27, 2026 957 CMR: Center for Health Information and Analysis

957 CMR 5.00: HEALTH CARE CLAIMS, CASE MIX AND CHARGE DATA RELEASE PROCEDURES

Effective February 27, 2026

Section

957 CMR 5.00 Health Care Claims, Case Mix and Charge Data Release Procedures (PDF)

5.01 General Provisions

5.01: General Provisions

5.02 Definitions

5.02: Definitions

5.03 Data Access

5.03: Data Access

5.04 Data Requests from Government Agencies for a Public Purpose

5.04: Data Requests from Government Agencies for a Public Purpose

5.05 Data Requests from Providers, Provider Organizations and Payers for Treatment,

5.05: Data Requests from Providers, Provider Organizations and Payers for Treatment, Payment, or Health Care Operations

5.06 Data Requests for Research

5.06: Data Requests for Research

5.07 Data Requests for De-identified Data

5.07: Data Requests for De-identified Data

5.08 Compliance and Penalties

5.08: Compliance and Penalties

5.09 Sub-Regulatory Guidance

5.09: Sub-Regulatory Guidance

5.10 Severability

5.10: Severability

5.01 General Provisions

5.01: General Provisions

(1) Scope and Purpose. The purpose of 957 CMR 5.00 is to govern the disclosure of Data collected, stored, and maintained by CHIA under M.G.L. c. 12C, and to specify the process for requesting such data as authorized by M.G.L. c. 12C. (2) Applicability. This regulation applies to Data collected, stored, and maintained by CHIA, and governs all requests for access to such Data.

(3) Authority. This regulation is issued pursuant to M.G.L. c. 12C, including but not limited to, §§ 3, 5, and 8, 10, 11, and 12.

5.02 Definitions

5.02: Definitions

All defined terms in 957 CMR 5.00 are capitalized. Any other term used in this regulation but not defined herein shall have the meaning given to the term by M.G.L. c. 12C, other CHIA regulations, or Sub-Regulatory Guidance.

As used in 957 CMR 5.00, unless the context requires otherwise, the following words shall have the following meanings:

APCD Data. Claims information submitted to CHIA for the All-Payer Claims Database pursuant to M.G.L. c. 12C, § 10, including, but not limited to, data regarding member eligibility, products, benefit plans, providers, encounters, and medical, pharmacy, or dental claims.

Case Mix Data. Case specific, encounter type information submitted by hospitals to CHIA pursuant to M.G.L. c. 12C, § 8, including Provider details and patient details, such as admission, diagnostic discharge data describing the demographic characteristics of the patient, the medical reason for the admission, procedural coding, treatment and services

Adopted Regulation Effective February 27, 2026 957 CMR: Center for Health Information and Analysis

957 CMR 5.00: HEALTH CARE CLAIMS, CASE MIX AND CHARGE DATA RELEASE PROCEDURES

Effective February 27, 2026

provided to the patient, and the duration and status of the patient's stay in the hospital. Case Mix data includes hospital inpatient discharge data, outpatient observation data, emergency department visit data and behavioral health inpatient data. Charge Data. The full, undiscounted total and service-specific charges billed by the hospital to the general public.

CHIA or Center. The Center for Health Information and Analysis established under M.G.L. c. 12C.

Data. APCD Data, Case Mix Data or Charge Data as defined in 957 CMR 5.02, aggregated reports of such data, and any other De-identified Data or Identifiable Data. Data is not a public record under clause Twenty-sixth of section 7 of chapter 4 and section 10 of chapter 66.

De-identified Data. Health care information concerning an individual patient, insurance member, or recipient of health care services that does not identify such individual and with respect to which there is no reasonable basis to believe the information can be used to identify such individual. CHIA may de-identify Data using methods such as those that satisfy the requirements of the Health Insurance Portability and Accountability Act of 1996, 42 U.S.C. § 1320d-1320d-8, and its implementing regulations at 45 C.F.R. § 164.514(a)-(c), including the Safe Harbor method or the Expert Determination method. Executive Director. The Executive Director of CHIA appointed pursuant to M.G.L. c. 12C, § 2, or their designee.

Government Agency. Any federal or state (including the District of Columbia and any United States territory) agency, department, authority, commission, board, bureau, or other similar entity; and any political subdivision of the Commonwealth, including a municipality.

Health Care Operations. Any of the following activities conducted by a Provider, Provider Organization, or Payer, to the extent that the activities are related to covered functions: conducting quality assessment and improvement activities; population-based activities relating to improving health or reducing health care costs; protocol development; case management and care coordination; contacting of health care providers and patients with information about treatment alternatives; professional review and performance evaluation; medical review, legal services, and auditing functions; business planning and development; business management and general administrative activities; customer service; resolution of internal grievances; due diligence activities in connection with the sale or transfer of assets; and underwriting, enrollment, premium rating, and other activities related to the creation, renewal, or replacement of a contract of health insurance or health benefits; provided, however, that for purposes of 957 CMR 5.00, Health Care Operations shall not include marketing activities as defined in 45 C.F.R. § 164.501, communications designed to encourage individuals to purchase or use products or services, or fundraising activities.

Adopted Regulation Effective February 27, 2026 957 CMR: Center for Health Information and Analysis

957 CMR 5.00: HEALTH CARE CLAIMS, CASE MIX AND CHARGE DATA RELEASE PROCEDURES

Effective February 27, 2026

Identifiable Data. Health care information concerning an individual patient, insurance member, or recipient of health care services that identifies such individual, or with respect to which there is a reasonable basis to believe the information can be used to identify such individual. This term includes but is not limited to protected health information as defined under the Health Insurance Portability and Accountability Act of 1996, and may include information beyond the scope of such protected health information.

Legally-Protected Health Care Activity. (i) the exercise and enjoyment, or attempted exercise and enjoyment, by any person of rights to reproductive health care services or gender-affirming health care services secured by the constitution or laws of the commonwealth or the provision of insurance coverage for such services; or (ii) any act or omission undertaken to aid or encourage, or attempt to aid or encourage, any person in the exercise and enjoyment, or attempted exercise and enjoyment, of rights to reproductive health care services or gender-affirming health care services secured by the constitution or laws of the commonwealth; provided, however, that the provision of such a health care service by a person duly licensed under the laws of the commonwealth and physically present in the commonwealth and the provision of insurance coverage for such services shall be legally protected if the service is permitted under the laws of the commonwealth, regardless of the patient’s location; and provided further, that “legally-protected health care activity” shall not include any service rendered below an applicable professional standard of care or that would violate anti-discrimination laws of the commonwealth. Payer. Any entity, other than an individual, that pays providers for the provision of health care services;

Payment. Activities undertaken by a Provider or Payer to obtain or provide reimbursement for the provision of health care, including but not limited to: determinations of eligibility or coverage; adjudication or subrogation of health benefit claims; risk adjusting amounts due based on enrollee health status and demographic characteristics; billing, claims management, collection activities, obtaining payment under a contract for reinsurance; and review of health care services with respect to medical necessity, coverage under a health plan, appropriateness of care, or justification of charges.

Provider. Any person, corporation partnership, governmental unit, state institution or any other entity qualified under the laws of the commonwealth to perform or provide health care services. Provider Organization. Any corporation, partnership, business trust, association or organized group of persons, which is in the business of health care delivery or management, whether incorporated or not that represents 1 or more health care providers in contracting with carriers for the payments of heath care services, including but not limited to, physician organizations, physician-hospital organizations, independent practice associations, provider networks, accountable care organizations and any other organization that contracts with carriers for payment for health care services.

Adopted Regulation Effective February 27, 2026 957 CMR: Center for Health Information and Analysis

957 CMR 5.00: HEALTH CARE CLAIMS, CASE MIX AND CHARGE DATA RELEASE PROCEDURES

Effective February 27, 2026

Research. A systematic investigation, including research development, testing, and evaluation, designed to develop or contribute to generalizable knowledge. Internal business research, on its own, however, is not considered “research” because its primary purpose is not to produce generalizable knowledge.

Sub-Regulatory Guidance. An Administrative Bulletin, notice, manual, guide, or other document, that, among other things specifies deadlines or technical submission requirements, or contains methodological explanations and examples to facilitate understanding of and compliance with adopted regulations.

Treatment. The provision, coordination, or management of health care and related services by one or more health care providers, including the coordination or management of health care by a health care provider with a third party; consultation between health care providers relating to a patient; or the referral of a patient for health care from one health care provider to another.

5.03 Data Access

5.03 : Data Access

(1) All requests for Data shall be made in writing to CHIA in a form or manner specified by CHIA.

(2) All Data recipients shall comply with the privacy and security requirements established in 957 CMR 5.03, unless such requirements violate applicable law. Prior to receiving any Data, recipients shall enter into a written agreement with CHIA that memorializes these privacy and security obligations and may include additional terms for Data access. The requirements set forth in 957 CMR 5.03(2) cannot be waived or modified by agreement, and in the event of any conflict between an agreement and this regulation, the provisions of 957 CMR 5.03 shall control. At a minimum, recipients must:

(a) Restrict the access to, and use of, the Data to uses identified in the application or agreement with CHIA, including Data matching or linking; (b) Implement administrative, physical, and technical safeguards to protect Data from unauthorized access, acquisition, disclosure, destruction, alteration, accidental loss, misuse, or damage that are no less rigorous than generally accepted industry practices and standards of care and diligence required by CHIA, including if applicable, maintaining a written information security program that complies with M.G.L. c. 93H and 201 CMR 17.00; (c) Destroy or return the Data upon completion of the approved project. All data destruction must comply with applicable destruction and retention required, standards under state or federal law, including if applicable,

Adopted Regulation Effective February 27, 2026 957 CMR: Center for Health Information and Analysis

957 CMR 5.00: HEALTH CARE CLAIMS, CASE MIX AND CHARGE DATA RELEASE PROCEDURES

Effective February 27, 2026

M.G.L. c. 93I; (d) Ensure that any third party with access to Data, including a contractor, subcontractor, or agent, complies with all requirements set forth in 957 CMR 5.03(2), and is bound by written agreement with the primary recipient to the same privacy, security, and use restrictions applicable to the primary recipient, with the recipient remaining fully liable for any third-party violations; (e) Not attempt to contact individuals whose information is contained in the Data, unless expressly authorized by CHIA and in compliance with applicable law; (f) Notify CHIA of any unauthorized use or disclosure of the Data; (g) Permit CHIA to review all analyses, research or other products created or based on Data provided by CHIA prior to the release or disclosure of any such analyses, research or products; (h) Permit CHIA to audit the recipients’ compliance with the requirements of 957 CMR 5.00 and any applicable agreement with CHIA; and (i) Withhold access to any Data, including De-Identified Data, or any other data or information derived from CHIA Data that would allow the identification of a patient or Provider, in response to any inquiry or investigation into services constituting a Legally-Protected Health Care Activity, except as required by federal law.

(3) After receipt of Data from CHIA, the recipient shall be deemed responsible for any breach of privacy or security, unauthorized access, disclosure, misuse, or other violation arising from the recipient’s possession, use, or control of the Data.

(4) All requests for Data will be reviewed by CHIA. The Executive Director will approve or deny such requests based on the criteria set forth in 957 CMR 5.00, and any other considerations necessary to protect patient privacy, ensure data security, and fulfill CHIA’s statutory obligations under M.G.L. c. 12C. The Executive Director may approve requests with conditions or modifications to ensure compliance with applicable law and this regulation.

(5) CHIA may charge a fee to entities requesting Data, as established under M.G.L. c. 12C, § 12(b). Fee schedules will be issued by CHIA through Sub-Regulatory Guidance.

(6) CHIA shall not release Data under 957 CMR 5.00 in response to a public record request.

(7) Except as required by federal law, CHIA shall not provide access to any Data, including De-identified Data, that would allow the identification of a patient or Provider in response to an inquiry or investigation into services constituting Legally-Protected Health Care Activity.

Adopted Regulation Effective February 27, 2026 957 CMR: Center for Health Information and Analysis

957 CMR 5.00: HEALTH CARE CLAIMS, CASE MIX AND CHARGE DATA RELEASE PROCEDURES

Effective February 27, 2026

(8) Data shall not be used to: (i) conduct a criminal, civil or administrative investigation into any individual patient; or (ii) impose criminal, civil or administrative liability on any individual patient.

(9) Access to Identifiable Data of an individual, including personal data as defined in section 1 of chapter 66A, authorized under this section shall be deemed to comply with the requirements of chapter 66A.

(10) CHIA may deny requests for reasons including but not limited to the following: the request does not satisfy 957 CMR 5.00, is inconsistent with CHIA’s statutory mandates, would violate applicable laws, or presents unacceptable privacy or security risks.

5.04 Data Requests: Government Agencies for Public Purpose

5.04: Data Requests: Government Agencies for Public Purpose

(1) A Government Agency may request Data to use for a public purpose.

(2) When requesting Data, the Government Agency must identify and demonstrate the public purpose(s) for which the Data is sought. In reviewing such requests, CHIA shall evaluate and determine whether the Data requested is necessary to accomplish the identified public purpose(s). (3) If the request is necessary to accomplish the identified public purpose(s), and meets the applicable requirements of 957 CMR 5.00, CHIA shall fulfill the request to the extent permissible under state and federal laws protecting patient privacy, confidentiality, and data security. (4) Data provided under this section may include Identifiable Data.

5.05 Data Requests: Providers, Provider Organizations, and Payers for Treatment,

5.05: Data Requests: Providers, Provider Organizations, and Payers for Treatment, Payment or Health Care Operations (1) A Provider, Provider Organization, or Payer may request Data for the purpose of carrying out Treatment, Payment or Health Care Operations. (2) If the request demonstrates that the Data is necessary to accomplish the purpose of carrying out Treatment, Payment or Health Care Operations, and meets the applicable requirements of 957 CMR 5.00, CHIA shall fulfill the request to the extent permissible under state and federal laws protecting patient privacy, confidentiality, and data security. (3) Data provided under this section may include Identifiable Data.

Adopted Regulation Effective February 27, 2026 957 CMR: Center for Health Information and Analysis

957 CMR 5.00: HEALTH CARE CLAIMS, CASE MIX AND CHARGE DATA RELEASE PROCEDURES

Effective February 27, 2026

5.06 Data Requests: Research

5.06: Data Requests: Research

(1) Identifiable Data may be requested for Research.

(2) A request for Identifiable Data for Research shall include, at a minimum, the following: (a) A detailed description of the Research purpose, including:

1. The Research objectives, rationale, methodology, and procedures.
2. A detailed project summary that describes any other data sources other than those requested from CHIA to be used for the project; and
3. A demonstration that the Research objectives cannot be achieved using De-Identified Data and that the requested Identifiable Data is necessary (b) A description of how the results of the Research will be published or otherwise contribute to generalizable knowledge. (c) Evidence of authorization to receive Identifiable Data that satisfies the requirements of 45 C.F.R . § 164, either through:
4. Authorization from the individual patient(s) whose data is being requested; or
5. Waiver of individual authorization approved by an institutional review board or privacy board.

(3) If the request meets the applicable requirements of 957 CMR 5.00, CHIA may fulfill the request to the extent permissible under state and federal laws protecting patient privacy, confidentiality, and data security.

5.07 Data Requests: De-Identified Data

5.07: Data Requests: De-Identified Data

(1) De-Identified Data may be requested for the following purposes: (a) Lowering total medical expenses, (b) Coordinating care, (c) Benchmarking, (d) Quality analysis, (e) Research, (f) Administrative or planning purposes, (g) Informing consumer health care decisions, or (h) Other purposes that aim to improve health care or public health outcomes for commonwealth residents that are consistent with CHIA’s stated mission.

(2) If the request meets the applicable requirements of 957 CMR 5.00, CHIA may fulfill the request to the extent permissible under state and federal laws protecting patient privacy, confidentiality, and data security.

Adopted Regulation Effective February 27, 2026 957 CMR: Center for Health Information and Analysis

957 CMR 5.00: HEALTH CARE CLAIMS, CASE MIX AND CHARGE DATA RELEASE PROCEDURES

Effective February 27, 2026

(3) Recipients of De-Identified Data shall not use such information or data to identify any person for any purpose.

5.08 Compliance and Penalties

5.08: Compliance and Penalties

(1) Sanctions. If a recipient fails to comply with any of the requirements and conditions for receiving Data under 957 CMR 5.00, CHIA may: (a) deny future access to Data; (b) terminate current access to all Data; (c) demand and secure the destruction or return of all Data; (d) undertake any other actions to ensure the privacy, security, and confidentiality of the Data.

(2) Penalties. A recipient that fails to comply with the requirements of 957 CMR 5.00 shall be subject to all penalties and remedies allowed by law, including but not limited to M.G.L. c. 214, § 1B and M.G.L. c. 93A. A violation of the prohibition on using Data to conduct an investigation into any individual patient or to impose liability on any individual patient, as stated in 957 CMR 5.03(8), shall constitute a violation of M.G.L. c. 93A. CHIA will notify state and federal law enforcement officials, as applicable, of violations of 957 CMR 5.00 and the related agreements made with Data recipients.

5.09 Sub-Regulatory Guidance

5.09: Sub-Regulatory Guidance

CHIA may, from time to time, issue Sub-Regulatory Guidance to clarify its requirements, policies, and procedures under 957 CMR 5.00 and to establish fees.

5.10 Severability

5.10: Severability

The provisions of 957 CMR 5.00 are severable. If any provision or the application of any provision is held to be invalid or unconstitutional, such invalidity shall not be construed to affect the validity or constitutionality of any remaining provisions of 957 CMR 5.00 or the application of such provisions.

REGULATORY AUTHORITY

957 CMR 5.00: M.G.L. c. 12C