J.1.A__ZPICUSOWAppendices-A-K.doc

Zone Program Integrity Contractor

Appendices

List of Appendices

A. DELIVERABLES

B. TRANSFER OF BENEFIT INTEGRITY MANAGER INFORMATION FROM AFFILIATED CONTRACTOR AND THE MEDICARE ADMINISTRATIVE CONTRACTOR

C. DATA RELEASE POLICIES AND PROCEDURES

D. RECORDS RETENTION

E. IRISFI OPERATING INSTRUCTIONS (AUGUST 1995)

F. MEMORANDUM OF UNDERSTANDING WITH LAW ENFORCEMENT

G. UNIFORM DESK REVIEW

H. FREEDOM OF INFORMATION GROUP POLICY AND PROCEDURAL GUIDE

I. ZPIC EDIT DIFFERENTIATION CHART

J. GLOSSARY AND ACRONYMS

K. CMS ARTS COST REPORTING DEFINITIONS

L. MEDI-MEDI POLICIES AND PROCEDURES MANUAL

M. PART C AND PART D INTEGRITY MANUAL

N. PRESCRIPTION DRUG EVENT DATA

O. DATA RELEASE POLICIES AND PROCEDURES UNDER THE PRIVACY ACT OF 1974

P. INSTRUCTIONS FOR COMPLETING THE MEDICARE PRESCRIPTION DRUG PLAN BID FORM FOR CONTRACT YEAR 2006

Q. PDP BID PRICING TOOL

R. MARx USER INFORMATION

S. WEEKLY WORKLOAD AND COMPLAINT ACTIVITY REPORT

T. EARNED VALUE MANAGEMENT INDUSTRY STANDARD EIA-748 MONTHLY EVMS PERFORMANCE REPORTS

The following Appendices are available on the Internet and are hereby incorporated with the same force and effect as if they were provided in full text herein.

U. BUSINESS PARTNERS SYSTEM SECURITY MANUAL

http://www.cms.hhs.gov/manuals/downloads/117_systems_security.pdf

V. PROGRAM INTEGRITY MANUAL

http://www.cms.hhs.gov/Manuals/IOM/itemdetail.asp?filterType=none&filterByDID=-99&sortByDID=1&sortOrder=ascending&itemID=CMS019033

W. LOCAL COVERAGE DETERMINATIONS

http://www.cms.hhs.gov/mcd/search.asp

X. MEDICARE NATIONAL COVERAGE DERTERMINATIONS MANUAL

http://www.cms.hhs.gov/Manuals/IOM/itemdetail.asp?filterType=none&filterByDID=-99&sortByDID=1&sortOrder=ascending&itemID=CMS014961&intNumPerPage=10

Y.

DATA USE AGREEMENT (DUA)

http://www.cms.hhs.gov/CMSForms/CMSForms/itemdetail.asp?filterType=keyword&filterValue=DUA&filterByDID=0&sortByDID=1&sortOrder=ascending&itemID=CMS045932

Z. SUPPLEMENT TO DUA

http://www.cms.hhs.gov/cmsforms/downloads/cms-r-0235a.pdf

AA. CMS ANNUAL FREEDOM OF INFORMATION ACT (FOIA) REPORT

http://www.cms.hhs.gov/FOIA/05_annualreports.asp#TopOfPage.cms.hhs.gov/FOIA/

BB. FREEDOM OF INFORMATION ACT (FOIA) REQUEST FORM (CMS FORM 632)

http://www.cms.hhs.gov/FOIA/04_reqfrm.asp#TopOfPage

CC. INSTRUCTIONS FOR MA BIDS

http://www.cms.hhs.gov/healthplans/

DD. MA-PD BID PRICING TOOLS

http://www.cms.hhs.gov/pdps/

EE. BESS USER’S GUIDE

http://www.cms.hhs.gov/NonIdentifiableDataFiles/03_PartBExtractSummarySystem.asp FF. Access to CMS Computer Systems Form http://www.cms.hhs.gov/AccesstoDataApplication/Downloads/Access.pdf

GG. NOTICE OF PROPOSED RULEMAKING - E-PRESCRIBING

http://a257.g.akamaitech.net/7/257/2422/01jan20051800/edocket.access.gpo.gov/2005/pdf/05-1773.pdf

HH. CMS CERTIFICATION AND ACCREDITATION METHOLOGY

http://www.cms.hhs.gov/InformationSecurity/ List of Exhibits

E-1. FEDERAL REGISTER NOTICES

www.gpo.gov

E-2. CMS RULINGS

www.cms.hhs.gov/rulings/

E-3. SELF-ASSESSMENT

(see Government Team Leader for current self-assessment)

E-4 MEDICARE GENERAL INFORMATION, ELIGIBILITY AND ENTITLEMENT MANUAL

E-5 MEDICARE BENEFIT POLICY MANUAL

E-6 MEDICARE CLAIMS PROCESSING MANUAL

E-7 MEDICARE SECONDARY PAYER MANUAL

E-8 MEDICARE FINANCIAL MANAGEMENT MANUAL

E-9 MEDICARE CONTRACTOR BENEFICIARY AND PROVIDER COMMUNICATIONS MANUAL

E-10 STATE BUY-IN MANUAL

E-11 DEMONSTRATIONS

E-12. QUALITY IMPROVEMENT ORGANIZATION MANUAL

http://www.cms.hhs.gov/Manuals/IOM/itemdetail.asp?filterType=none&filterByDID=-99&sortByDID=1&sortOrder=ascending&itemID=CMS019035&intNumPerPage=10

E-13. MEDICARE ESRD ORGANIZATION MANUAL

http://www.cms.hhs.gov/Manuals/IOM/itemdetail.asp?filterType=none&filterByDID=-99&sortByDID=1&sortOrder=ascending&itemID=CMS019209&intNumPerPage=10

E-14. STATE OPERATIONS MANUAL

http://www.cms.hhs.gov/Manuals/IOM/itemdetail.asp?filterType=dual, keyword&filterValue=medicaid&filterByDID=0&sortByDID=1&sortOrder=ascending&itemID=CMS050483&intNumPerPage=10

E-15. MEDICARE MANAGED CARE MANUAL

http://www.cms.hhs.gov/Manuals/IOM/itemdetail.asp?filterType=none&filterByDID=-99&sortByDID=1&sortOrder=ascending&itemID=CMS019326&intNumPerPage=10

E-16. HOME HEALTH AGENCY MANUAL

http://www.cms.hhs.gov/Manuals/PBM/itemdetail.asp?filterType=none&filterByDID=-99&sortByDID=1&sortOrder=ascending&itemID=CMS021914&intNumPerPage=10

E-17. HOSPICE MANUAL

http://www.cms.hhs.gov/Manuals/PBM/itemdetail.asp?filterType=none&filterByDID=-99&sortByDID=1&sortOrder=ascending&itemID=CMS021923&intNumPerPage=10

E-18. HOSPITAL MANUAL

http://www.cms.hhs.gov/manuals/pbm/itemdetail.asp?filterType=none&filterByDID=0&sortByDID=1&sortOrder=ascending&itemID=CMS021912&intNumPerPage=10

E-19. CARRIER MANUAL

http://www.cms.hhs.gov/Manuals/PBM/itemdetail.asp?filterType=none&filterByDID=-99&sortByDID=1&sortOrder=ascending&itemID=CMS021921&intNumPerPage=10

E-20. INTERMEDIARY MANUAL

http://www.cms.hhs.gov/Manuals/PBM/itemdetail.asp?filterType=none&filterByDID=-99&sortByDID=1&sortOrder=ascending&itemID=CMS021918&intNumPerPage=10

E-21. PEER REVIEW ORGANIZATION MANUAL

http://www.cms.hhs.gov/Manuals/PBM/itemdetail.asp?filterType=none&filterByDID=0&sortByDID=1&sortOrder=ascending&itemID=CMS021922&intNumPerPage=10

E-22. PROVIDER REIMBURSEMENT MANUAL P. I

http://www.cms.hhs.gov/Manuals/PBM/itemdetail.asp?filterType=none&filterByDID=0&sortByDID=1&sortOrder=ascending&itemID=CMS021929&intNumPerPage=10

E-23. PROVIDER REIMBURSEMENT MANUAL P. II

http://www.cms.hhs.gov/Manuals/PBM/itemdetail.asp?filterType=none&filterByDID=0&sortByDID=1&sortOrder=ascending&itemID=CMS021935&intNumPerPage=10

E-24. MEDICARE RENAL DIALYSIS FACILITY MANUAL

http://www.cms.hhs.gov/Manuals/PBM/itemdetail.asp?filterType=none&filterByDID=0&sortByDID=1&sortOrder=ascending&itemID=CMS021926&intNumPerPage=10

E-25. MEDICARE RURAL HEALTH CLINIC MANUAL

http://www.cms.hhs.gov/Manuals/PBM/itemdetail.asp?filterType=none&filterByDID=0&sortByDID=1&sortOrder=ascending&itemID=CMS021925&intNumPerPage=10

E-26. SKILLED NURSING FACILITY MANUAL

http://www.cms.hhs.gov/Manuals/PBM/itemdetail.asp?filterType=none&filterByDID=0&sortByDID=1&sortOrder=ascending&itemID=CMS021915&intNumPerPage=10

E-27. HEALTH CARE PROVIDER COST REPORT INFORMATION SYSTEM (HCRIS)

http://www.cms.hhs.gov/CostReports/

E-28. CARRIER STANDARD SYSTEM USER GUIDE

http://www.cms.hhs.gov/ElectronicBillingEDITrans/08_HealthCareClaims.asp

E-29. INTERMEDIARY STANDARD SYSTEM USER GUIDE

www.cms.hhs.gov/providers/psc/userguid.asp

E-30. DURABLE MEDICAL EQUIPMENT REGIONAL CARRIER (DMERC) STANDARD SYSTEM USER GUIDE www.cms.hhs.gov/providers/psc/userguid.asp

E-31. COVERAGE DECISION MEMOS

http://www.cms.hhs.gov/DeterminationProcess/

E-32, SECURITY CLAUSE

http://cmsnet.cms.hhs.gov/hpages/oagm/PolicyNotices.htm

A. DELIVERABLES

ITEMS TO BE FURNISHED AND DELIVERABLE SCHEDULE

The Contractor shall submit all required reports and deliverables in accordance with the following schedule. Reports and/or deliverables submitted under this contract shall be in accordance with the Statement of Work entitled Zone Program Integrity Contractor Statement of Work.

DBIMO = Division of Benefit Integrity Management Operations

DMRE = Division of Medical Review & Education

IAW= In Accordance With

NCW = Medi-Medi National Coordinator Website

NLT = No Later Than

OPISI = One Program Integrity Systems Integrator

POC = Point of Contact

Notes:

1. All deliverables shall be entered into the CMS ARTS. All CMS ARTS deliverables shall be delivered electronically via email and/or secure email to the recipients noted, or as otherwise indicated in the schedule.

2. ALL DELIVERABLES, REGARDLESS OF CONTENT or METHOD OF SHIPMENT, SHALL BE “TRACKED” IN THE CMS ARTS. Additionally, all deliverable “content” shall be submitted into the CMS ARTS with the exception of deliverables that contains confidential and/or sensitive information and/or as otherwise noted (hard copy, etc.). Deliverable content that contains confidential or sensitive information shall be submitted via a secure method of shipment, e.g. secure email (preferable) or hard copy.

3. Deliverable dates that fall on a weekend or holiday shall be due on the first subsequent business day after the weekend or holiday.

Deliverables Schedule

IAW SOW Chap. 1, §1.2.1.3 and §1.2.3.2.3 Primary GTL, Associate GTL, AC(s)

Outgoing Contractor(s)

IAW SOW Chap. 1, §1.2.1.3

IAW SOW Chap. 1, §1.2.3.2.5

IAW SOW Chap. 1, §1.2.3.2.5

IAW SOW Chap. 1, §1.2.3.2.5

IAW SOW Chap. 2, §2.4.4.1

After the 1st year, semi-annually on 1/15 and 7/15.

Hard Copy to AC or MAC, CD-ROM to CO, CMS ARTS

IAW SOW Chap. 1, §1.2.3.2.6

IAW SOW Chap. 1, §1.2.3.2.6

IAW SOW Chap. 1, §1.2.3.2.7

IAW SOW Chap. 1, §1.2.3.2.7

IAW SOW Chap. 1, §1.2.3.2.8 and Chap. 4, §4.9.2

CMS ARTS

IAW SOW Chap. 1, §§1.2.3.2.9 and 1.2.3.2.9.1

IAW SOW Chap. 1, §1.2.3.2.9.2

April 1 CD-ROM, Timestamp in CMS ARTS, Email notification

Chap. 1, §1.5.7.2.5

IAW SOW Chap. 1, §1.5.7.2.5

IAW SOW Chap. 1, §1.5.7.2.3 and IOM Pub. 100-06

IAW SOW Chap. 1, §1.5.7.2.5. Also, referred to as the Security IT Systems Contingency Plan.

Thereafter, 365 calendar days from the last date submitted or updated and 30 calendar days after a major system change.

DBIMO SSO Approvals to GTL & Associate GTL within 10 working days.

CD-ROM, CMS ARTS, Email notification

IAW SOW Chap. 1, §1.2.3.2.10 and §1.5.3 and Chap. 4, §4.9.5

Subsequent changes within 40 calendar days of identification of a change.

CMS ARTS, E-mail notification, NCW

IAW SOW Chap. 1, §1.4.4 and §2.4.2

IAW SOW Chap. 2, §2.4.1 and Appendix M, §13

IAW SOW Chap. 2, §2.4.1

IAW SOW Chap. 1, §1.5.4.1 and §1.5.4.2

IAW SOW Chap.1, §1.5.1.1 & Appendix Y

IAW SOW Chap. 1, §1.5.2.1

IAW contract section H

IAW contract section H

IAW contract section H

IAW SOW Chapter 1, §1.2.3.2.12 & Appendix H

IAW SOW Chapter 1, §1.2.3.2.12 & Appendix H

IAW SOW Chap. 1, §1.2.3.2.12 and Appendix BB

IAW SOW Chap. 1, §1.2.3.2.12 and Appendix AA

54.

Strategy Analysis Report (SAR)

IAW SOW Chap. 1, §1.7.1

BI is fully transitioned to a MAC.)

E-mail Notification, CMS ARTS

IAW SOW Chap. 1, §1.7.1

BI is fully transitioned to a MAC.)

E-mail Notification, CMS ARTS

IAW SOW Chap. 1, §1.2.3.1

Subsequent changes within 15 calendar days of identification of a change.

E-mail notification, NCW, CMS ARTS

Subsequent changes within 15 calendar days of identification of a change.

E-mail notification, NCW, CMS ARTS

Recipient Addresses:

Theresa Schultz

Contracting Officer (CO)

Centers for Medicare & Medicaid Services

Office of Acquisition and Grants Management

Medicare Contracts Group

Division of Medicare Support Contracts

7500 Security Blvd, Mail Stop: C2-21-15

Baltimore, Maryland 21244

Email:

Theresa.Schultz@CMS.HHS.Gov Phone:

410-786-8496

Location:

C2-24-16 Project Officer (PO)

Centers for Medicare & Medicaid Services

Office of Financial Management

7500 Security Blvd, Mail Stop: C3-02-16

Baltimore, Maryland 21244

Government Task Leader (GTL)

As defined in task order Statement of Work

Associate Government Task Leader (Associate GTL)

As defined in the task order Statement of Work

CMS Division of Benefit Integrity Management Operations (DBIMO)

Centers for Medicare & Medicaid Services

Office of Financial Management

7500 Security Blvd, Mail Stop: C3-02-16

Baltimore, Maryland 21244

CMS Division of Benefit Integrity Management Operations (DBIMO) Systems Security Officer

Centers for Medicare & Medicaid Services

OFM/PIG/DBIMO

7500 Security Blvd., Mail Stop: C3-02-16

Baltimore, Maryland 21244

CMS Division of Benefit Integrity Management Operations (DBIMO) Medi-Medi Program Lead

Centers for Medicare & Medicaid Services

OFM/PIG/DBIMO

7500 Security Blvd., Mail Stop C3-02-16

Baltimore, Maryland 21244

CMS Division of Medical Review & Education (DMRE) Centers for Medicare & Medicaid Services

OFM/PIG/DMRE

7500 Security Blvd, Mail Stop: C3-02-16

Baltimore, Maryland 21244

Division of MMA Integrity

Centers for Medicare & Medicaid Services

Office of Financial Management/Program Integrity Group/Division of MMA Integrity

7500 Security Blvd., Mail Stop: C3-02-16

Baltimore, Maryland 21244

Regional Office FOIA Coordinator

TBD

Until the RO FOIA Coordinator is identified, please submit to:

Sam Seidman, Freedom of Information Specialist

Centers for Medicare & Medicaid Services

Freedom of Information Group

7500 Security Blvd, Mail Stop: N2-20-16

Baltimore, Maryland 21244

Fax: 410.786.0474

Phone: 410.786.3327

Small Business Administration (SBA)

CMS Small Business Specialist

Attn: Alice Roache

Centers for Medicare & Medicaid Services

Office of Acquisition and Grants Management

Acquisition Support & Policy

7500 Security Blvd, Mail Stop: C2-21-15

Baltimore, Maryland 21244 and

Linda Purnell

Dept. of Health and Human Services

Office of the Secretary

200 Independence Ave., SW, Room 517-D

Washington, DC 20201

B. TRANSFER OF BENEFIT INTEGRITY MANAGER INFORMATION FROM AFFILIATED CONTRACTOR AND THE MEDICARE ADMINISTRATIVE CONTRACTOR

The Zone Program Integrity Contractor (ZPIC) shall have access to the Affiliated Contractors’ (ACs’)and Medicare Administrative Contractors’ (MACs’) pricing files in order to make least-costly alternative decisions and other payment determinations that require clinical expertise.

The AC and the MAC will furnish the following information to the ZPIC:

· Local coverage determinations and internal medical review guidelines.

· Program safeguard edit parameters in hard copy format.

· Carrier Advisory Committee minutes for the past 3 years.

· Provider newsletters sent during the prior 3 years.

· A report highlighting program safeguard activities from the previous 12 months.

· Complex reviews and other post-pay reviews in process.

· All Benefit Integrity (BI) files (e.g., case referrals to Office of the Inspector General (OIG), fraud alerts, etc.).

· Medical documentation and other claims attachments for any claims currently under review and not yet paid.

· History of all contacts with specific providers for the last 3 years.

· Flagged providers/category III edits.

C. DATA RELEASE POLICIES AND PROCEDURES

1 - General

This section specifies the procedures that the Zone Program Integrity Contractor (ZPIC) shall follow under each of the Privacy Act (PA) data release provisions. The Centers for Medicare & Medicaid Services (CMS) is in the process of updating these procedures to incorporate privacy regulations of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and this appendix is subject to change upon their completion.

2 - Release of Data with Individual’s Consent

An individual may have access to any record maintained on him/her in a system of records. The ZPIC shall provide such access upon receipt of a request in writing and verification of the individual’s identity. The individual may request that data being maintained be sent to another party. ZPIC staff will send the data upon receipt of a completed Consent Statement. No fee will be charged for searching for an individual’s personal record or for a photocopy when a copy must be made in order to provide access to the record.

3 - Release of Identifiable Data Within CMS and Within Health and Human Services

3.1 - General

Identifiable data may be released within an agency from one employee to another employee on a need-to-know basis. That is, the requesting employee must need the data in identifiable form in order to perform his/her duties. The Department of Health and Human Services (HHS) is considered to be a single agency.

3.2 - Release Within CMS

Within CMS, both non-identifiable and identifiable data may be obtained from the Office of Information Services (OIS) by completing a Request for Information form. If identifiable data are requested, OIS will generally accept the CMS component’s determination that the data are needed in identifiable form unless it is obvious that more data are being requested than necessary or the data requested are unrelated to the purpose of the request. If the component intends to re-release the data to a contractor/grantee or other non-government entity, the CMS component and the non-government source must sign an Agreement for Release of Data with Individual Identifiers, binding the user to protect the confidentiality of the data. The agreement must be signed and must accompany the Request for Information form before data are released.

3.3 - Release Within HHS

Requestors outside of CMS, but within the Department of Health and Human Services, can also receive individually identifiable data on a need-to-know basis. CMS requires HHS agencies to meet the same criteria as are specified under the subsection Basic Routine Uses, below, and also to follow the same process. An exception to this is the approval of a research project by the component’s review panel, which will be accepted as establishing that the project is important and soundly designed. If the component plans to complete the research project in-house, the component will be required to sign a Federal Agreement for Release of Data with Individual Identifiers. There may be a charge for providing data.

4 - Release of Identifiable Data Outside of the Department for Purposes Compatible With Program Objectives (Routine Uses)

4.1 - General

Identifiable data may be released outside HHS without the beneficiary’s consent for “routine uses” that have been published in the Federal Register as part of the notice of the system of records containing the requested data. Routine uses must be compatible with purposes for which the data in the system were initially collected. Most of CMS’ routine uses are necessary in order to operate the Medicare/Medicaid programs: release to state welfare agencies, Quality Improvement Organizations, providers and suppliers, and state audit agencies, and to the Justice Department for litigation. A number of CMS components have routine uses for release of data for health research, for analysis of Medicare payment policies, for data processing by contractors, for determination of the quality and effectiveness of hospital care, for state agency cost containment, for Medicare hospital mortality analysis, and for other uses compatible with CMS’ mission. An outline of common routine uses follows. It should be noted that there is a charge, in most cases, for data released under a routine use.

4.2 - Basic Routine Uses

4.2.1 - Research Routine Use

Identifiable data may be released to an individual or organization for a health-related research evaluation or epidemiologic project when certain criteria (below) are met and a specific process is followed. (This provision for release of data is contained in System of Records notices for a number of CMS’ major data systems.)

4.2.1.1 - Criteria

· Purpose requires individually identifiable records.

· Project is of sufficient importance to warrant effect, or risk, on beneficiary privacy.

· There is reasonable probability that use of data will accomplish purpose, i.e., project is soundly designed and properly financed.

· Data will be protected and identifiers removed as soon as possible.

· Requester signs agreement to abide by CMS’ data release policies and procedures.

4.2.1.2 - Procedures to Obtain Data for Research Purposes

· Request is sent to the appropriate CMS component explaining purpose of the project, data needed, and how data would be used. The following documentation should accompany the request:

· Copy of research or evaluation protocol or detailed project plan that will be reviewed by research experts to determine if criteria are met.

· Copy of report of review by panel of scientists (if applicable).

· Copy of form (face sheet of grant/contract/cooperative agreement) showing that the project is funded.

· Documentation will be reviewed:

· To determine that data requested are available.

· By an appropriate CMS component to determine that the criteria are met. (This process takes approximately 6 weeks.) Approval by review panel of experts outside of CMS may be accepted as proof that the criteria are met.

· If all criteria are met, a data release agreement will be sent to the requester(s) for signature(s).

· This routine use may be used to release data under a CMS contract/grant/cooperative agreement. The component must obtain a copy of the data release agreement (or use a similar agreement that protects data confidentiality). The component and the contractor sign the agreement. A copy of the agreement must be sent to OIS where a master database of all CMS agreements is maintained.

· When the names and/or addresses of beneficiaries are requested to solicit them for participation in a research project not funded by CMS, a letter over the Administrator’s signature must be sent to each beneficiary.

4.2.2 - Data Processing Contractor Routine Use

This routine use permits release of identifiable data to CMS contractors for the purpose of data processing: collating, analyzing, aggregating, or otherwise processing data. Data would also be disclosed incidental to consultation, programming, operation or user assistance. ZPIC employees are required to sign statements agreeing to protect the data. (This provision is included in System of Records notices for all of CMS’ major data systems.)

4.2.3 - Quality and Effectiveness of Care MEDPAR (QC/MEDPAR) Routine Use - OIS Only

OIS will release the QC/MEDPAR to entities for research on, and evaluation of, the quality and effectiveness of care provided in hospitals. The focus must be on measures of determining, validating, evaluating, and monitoring quality and effectiveness in such areas as access and outcomes. A major difference between the characteristics of this file and the EXMM file is that the ZIP code of the beneficiary’s residence is provided, and an encrypted beneficiary health insurance account number is included, making it possible to follow the beneficiary from month to month and year to year.

4.2.3.1 - Criteria

· The research and/or evaluation purpose requires data in detailed form as provided in the file.

· The purpose is likely to be accomplished in light of requesting entity’s capabilities and other factors.

· The purpose is of sufficient importance to warrant effect on and risk to beneficiary privacy.

4.2.3.2 - Procedures to Obtain Data

Entity must submit to OIS, and CMS must approve the following:

· A research and/or an evaluation plan specifying the objectives of the research and/or evaluation, how data will be used, financial support, and completion date.

· A copy of report by panel of experts on review of plan (where such a review was performed).

Upon receipt of the above:

· The appropriate CMS component will review the plan and the documentation, determine if criteria are met, and provide a recommendation to OIS on release.

· Requester will be required to sign QC/MEDPAR data release agreement.

· Requester will be required to send a certified check/money order for the cost of the QC/MEDPAR file.

4.2.4 - State Agency Cost Containment and Quality and Effectiveness of Care Routine Use

CMS may release data with individual identifiers to a qualified state agency for purposes of determining, evaluating and/or assessing cost, effectiveness, and/or quality of health care services provided in the state. Release of the data is governed by the routine use published in the Federal Register on Thursday, December 29, 1988, page 52792. The agency must meet the criteria listed below and also follow the procedures specified below:

4.2.4.1 - Criteria

· Requesting organization must be an agency of a state government or established by state law.

· The data must be requested and used for the purpose of determining, evaluating and/or assessing cost, effectiveness and/or the quality of health care services provided in the state.

· Use or disclosure of the data must not violate legal limitations under which the data were provided, collected, or obtained.

· Once received by agency, data must be exempt from disclosure under any state/local Freedom of Information Act.

· Data with individual identifiers must be required to accomplish agency purposes.

· Agency purpose must be of sufficient importance to warrant effect and/or risk on beneficiary’s privacy.

· It must be reasonable to expect that the agency will be able to accomplish its purposes in using the data.

4.2.4.2 - Procedures to Obtain Data that State Agency Must Submit

State agency must submit:

· Documentation that it is a part of the state government or established by state law, e.g., submit a copy of enabling legislation.

· A copy of its operating plan that provides detail about goals, strategy, and activities that are being carried out and/or planned to accomplish goals, including periodic reports. It must be clear how CMS data would be used.

· Evidence that data would be exempt from any state or local Freedom of Information Act (FOIA).

· Signed data release agreement stipulating that state agency:

· Will not use data for other purposes.

· Will not publish data in a form permitting deduction of individual identities.

· Will submit a copy of aggregated data or proposed table shells to CMS prior to publication.

· Will make no further disclosure except for emergencies, to another CMS-approved project, or for official audits.

· Will establish reasonable safeguards to protect data.

4.2.4.3

- Expenses

As with other data released outside of CMS, there is a charge for data released to states.

4.2.5 - Congressional Office Routine Use

Data with individual identifiers may be released to a Congressional office in response to an inquiry made by the individual to the member of Congress. A separate provision of the Privacy Act authorizes release to the Congress itself or to a committee of the Congress. This provision is included in System of Records notice for all of CMS’ major data systems. (See Release of Identifiable Data to the Congress, below.)

4.2.6 - Bureau of the Census Routine Use

Data may be released to the Census Bureau to enable the Bureau to process research and statistical data for Social Security projects. A separate provision of the Privacy Act authorizes release of data for census purposes. This provision is included in System of Records notices for all of CMS’ major data systems. (See Release of Identifiable Data to the Bureau of the Census, below.)

4.2.7 - Justice Department (or Court or other Tribunal) Routine Use

This routine use authorizes release of identifiable data to the Department of Justice (or a court) in litigation where the Department of Justice has agreed to represent an employee of HHS in his/her official or private capacity. (This provision is included in System of Records notices for all of CMS’ major data systems.)

4.2.8 - Other Routine Uses

Various CMS systems have other routine uses in addition to those already mentioned in this subsection. For example, a new routine use was recently developed for OIS’s Medicare Bill File (Statistics). The new routine use permits the release of Medicare inpatient hospital data to allow an individual hospital to conduct mortality studies of its facility. As with all routine uses, there are specific procedures that hospitals must follow to obtain the data.

Due to the number of routine uses that evolve over time, and the specialized nature of each routine use, it is impractical to cover all of them in this guide. All routine uses are published in the Federal Register. A copy of the criteria for a particular routine use may be obtained by contacting the Privacy Act coordinator in the component that is designated the system manager.

5 - Release of Identifiable Data to the Bureau of the Census

Data may be released to the Census Bureau for census-taking purposes, including making population estimates between census taking and as a cross-check of persons missing in census counts of aged persons. Release for census purposes is specifically authorized by a special disclosure provision in the Privacy Act. Release of data to the Census Bureau for research with which the Census undertakes to assist other federal agencies must be authorized under the provisions of the routine use described in the preceding section, Release of Identifiable Data Outside of the Department for Purposes Compatible with Program Objectives (Routine Uses). CMS does require Census to sign a Federal Agreement for Release of Individual Identifiable Data. CMS may also recover its processing costs.

6 - Release of Statistical Data

Data that contain no individual identifiers or data elements that would permit the identity of a beneficiary to be deduced (e.g., date of birth, residence, ZIP code) may be released as statistical data. CMS releases many statistical tables containing aggregate data.

7 - Release for a Civil or Criminal Law Enforcement Activity

CMS releases identifiable information in response to requests from any governmental agency for law enforcement activities authorized by federal, state, or local law, upon the request of the head of the law enforcement agencies specifying the data needed and the law to be enforced. Data have been released to a state health department enforcing a law requiring family approval before removing a deceased individual’s organs for transplant purposes. Data were also released to the Department of Justice for enforcement activity involving restraint of trade. Attorneys in the Office of General Counsel may be queried formally or informally if there is doubt about the request.

8 - Release of Identifiable Data for the Health and Safety of the Individual

CMS may assist in the location of individuals where their health and safety is involved. For example, identifiable data were released to the Connecticut State Department of Health to locate individuals who had been exposed to benzene, a chemical that may cause bladder cancer. The employer was cooperating with the state in an effort to notify former employees of the possible danger and to offer an examination program. CMS has addresses for most individuals age 65 and over. Since few individuals under age 65 are Medicare beneficiaries, CMS coordinates with the Social Security Administration (SSA) to locate such individuals. SSA will forward a letter to the individuals at the individual’s last employer’s address.

9 - Release of Identifiable Data to the Congress

Data may be released to either House of Congress or for purposes falling under its jurisdiction to any committee, subcommittee, or joint committee. Data are furnished to the Congressional Budget Office and the Library of Congress for Congressional projects. The Prospective Payment Assessment Commission and the Physician Payment Review Commission have separate legislation authorizing release of data to them. Data are furnished as needed.

10 - Release of Identifiable Data to General Accounting Office

CMS cooperates fully with General Accounting Office.