08-1298. Medicare Program; Medicare Part D Claims Data

AGENCY:

Centers for Medicare & Medicaid Services (CMS), HHS.

ACTION:

Final rule.

SUMMARY:

This final rule allows the Secretary to collect claims data that are presently being collected for Part D payment purposes for other research, analysis, reporting, and public health functions. The Secretary needs to use these data because other publicly available data are not, in and of themselves, sufficient for the studies and operations that the Secretary needs to undertake as part of the Department of Health and Human Service's obligation to oversee the Medicare program, protect the public's health, and respond to Congressional mandates. These data will also be used to better identify, evaluate and measure the effects of the Medicare Modernization Act of 2003, (MMA).

DATES:

Effective Date: This regulation is effective June 27, 2008. Date of Applicability: This regulation applies to Part D claims data collected on or after January 1, 2006. Following the effective date of this final rule, we will recollect under section 1860D-12(b)(3)(D) of the Act any data that were first submitted prior to the effective date of this final rule by extracting them from the Part D claims data already collected for payment purposes.

FOR FURTHER INFORMATION CONTACT:

Alissa DeBoy, [phone]; Nancy DeLew, [phone].

SUPPLEMENTARY INFORMATION:

Copies: To order copies of the Federal Register containing this document, send your request to: New Orders, Superintendent of Documents, P.O. Box 371954, Pittsburgh, PA 15250-7954. Specify the date of the issue requested and enclose a check or money order payable to the Superintendent of Documents, or enclose your Visa or Master Card number and expiration date. Credit card orders can also be placed by calling the order desk at [phone] (or toll free at 1-888-293-6498) or by faxing to [phone]. The cost for each copy is $10. As an alternative, you can view and photocopy the Federal Register document at most libraries designated as Federal Depository Libraries and at many other public and academic libraries throughout the country that receive the Federal Register. This Federal Register document is also available from the Federal Register online database through GPO Access, a service of the U.S. Government Printing Office. The Web site address is: http:// www.access.gpo.gov/​fr/​index.html.

I. Background

A. Requirements for Issuance of Regulations

Section 902 of the Medicare Prescription Drug, Improvement, and Modernization Act of 2003 (MMA) (Pub. L. 108-173) amended section 1871(a)(3) of the Social Security Act (the Act) and requires the Secretary, in consultation with the Director of the Office of Management and Budget (OMB), to establish and publish timelines for the publication of Medicare final regulations based on the previous publication of a Medicare proposed or interim final regulation. Section 1871(a)(3)(B) of the Act also states that the timelines for these regulations may vary, but shall not exceed 3 years after publication of the preceding proposed or interim final regulation, except under exceptional circumstances. This final rule finalizes provisions set forth in our October 18, 2006 proposed rule. In addition, this final rule is being published within the 3-year time limit imposed by section 1871(a)(3)(B) of the Act. Therefore, we believe that the final rule is in accordance with the Congress's intent to ensure timely publication of final regulations.

B. General Overview

As stated in the October 18, 2006 proposed rule, under the Act, the Secretary has the authority to include in Part D sponsor contracts any terms or conditions the Secretary deems necessary and appropriate, including requiring the organization to provide the Secretary with such information as the Secretary may find necessary and appropriate. (See section 1857(e)(1) of the Act as incorporated into Part D through section 1860D-12(b)(3)(D) of the Act.)

We proposed to implement section 1860D-12(b)(3)(D) of the Act to allow the Secretary to collect the same claims information now collected under the authority of section 1860D-15 of the Act for purposes including reporting to the Congress and the public, conducting evaluations of the overall Medicare program, making legislative proposals to Congress, and conducting demonstration projects. While the purposes underlying such collection are discussed in more detail in this final rule, they include, but are not limited to, evaluating the effectiveness of the new prescription drug benefit and its impact on health outcomes, performing Congressionally mandated or other demonstration and pilot projects and studies, reporting to Congress and the public regarding expenditures and other statistics involving the new Medicare prescription drug benefit, studying and reporting on the Medicare program as a whole, and creating a research resource for the evaluation of utilization and outcomes associated with the use of prescription drugs.

We note that because this final rule applies to all Part D sponsors, it applies to any entity offering a Part D plan, including both prescription drug plan sponsors and Medicare Advantage organizations offering qualified prescription drug coverage. We further note that the Part D prescription drug event data (hereinafter also referred to as “Part D claims data”) collected in accordance with section 1860D-12(b)(3)(D) of the Act will include 37 drug claim elements submitted by drug plan sponsors to the Secretary, which in accordance with § 423.100, include not only data from claims for drugs, but also data from claims for insulin, biological products, certain medical supplies, and vaccines.

II. Provisions of the Proposed Rule With an Analysis of and Response to Public Comments

We received approximately 118 items of timely correspondence containing comments on the October 18, 2006 proposed rule. Commenters included health policy organizations, pharmacies and pharmacy-related organizations, members of the Congress, researchers, insurance industry representatives, physicians and other health care professionals, beneficiary advocacy groups, representatives of hospitals, Part D beneficiaries, a pharmacy benefit managers’ trade association and others.

In this final rule, we address all comments and concerns on the policies included in the proposed rule. The following lists the provisions of the proposed rule that received the most comments:

• External access to the data
• Uses for the data
• Privacy protections for the data

Generally, the vast majority of commenters expressed strong support for the proposed rule, declaring it essential for the success and accurate evaluation of the Medicare Part D program. There was also a significant amount of agreement among the commenters that external entities be allowed access to Part D claims data. Commenters pointed out that CMS could not possibly fund all the research needed, and because of that, allowing external entities access to these data is necessary in order to evaluate the many health care issues arising from the new prescription drug benefit. Commenters also noted that research by external entities is likely to result in lower government expenditures and better delivery of health care to beneficiaries. Many of the commenters supporting the rule cited multiple examples of the potential benefits to the public health that could result with the access to Part D claims data by qualified organizations and individuals, including assessing the impact prescription drugs have on the health outcomes of the elderly, cost efficiencies, quality of care measures, and the efficacy of prescription drugs.

A number of comments addressed privacy protections, which impact the collection and release of claims data, and other commenters expressed concern about sensitive financial information being released. The majority of commenters acknowledged that a risk to protected information exists; however, they believed that the risk is no greater than the risk involved when allowing access to currently available Medicare data.

Several commenters raised concerns about the inherent limitations associated with the use of claims data for research purposes and requested that we acknowledge these limitations. In the following sections, we address all of these comments.

A. General Provisions

1. Statutory Basis

On December 8, 2003, the Congress enacted the Medicare Prescription Drug, Improvement, and Modernization Act of 2003 (MMA) (Pub. L. 108-173). Title I of the MMA amended the Act to establish a new voluntary prescription drug benefit program, Medicare Part D. As we stated in the preamble to the January 28, 2005 final rule (70 FR 4197) implementing the new prescription drug benefit, we believe that the addition of outpatient prescription drug coverage to the Medicare program is the most significant change to the Medicare program since its inception in 1965.

Unlike Parts A and B of the Medicare program, where Medicare acts as the payer and insurer and generally pays for items and services on a fee-for-service basis, the prescription drug benefit is based on a private market model. Under this model, CMS contracts with private entities—prescription drug plan (PDP) sponsors, Medicare Advantage (MA) organizations, as well as other types of Medicare health organizations—who then act as the payers and insurers for prescription drug benefits. These private entities are generally referred to as “Part D sponsors” in our rules. Section 1860D-12 of the Act contains the majority of provisions governing the contracts CMS enters into with the Part D sponsors. That section, entitled, “Requirements for and contracts with prescription drug plan (PDP) sponsors,” incorporates by reference many of the contract requirements that previously were applicable to Medicare Advantage organizations.

One of the incorporated provisions at section 1860D-12(b)(3)(D) of the Act, is section 1857(e)(1) of the Act, which provides broad authority for the Secretary to add terms to the contracts with Part D sponsors, including terms that require the sponsor to provide the Secretary “with such information * * * as the Secretary may find necessary and appropriate.” We believe that the broad authority of section 1860D-12(b)(3)(D) of the Act authorizes us to collect most of the information we currently collect to properly pay sponsors under the statute. However, section 1860D-15 of the Act contains provisions that might be viewed as limiting such collection. Therefore, we engaged in this rulemaking in order to resolve the statutory ambiguity, as well as to implement the broad authority of section 1860D-12(b)(3)(D) of the Act.

Most of the payment provisions with respect to Part D sponsors are found in section 1860D-15 of the Act.^[1] Subsections (d) and (f) of section 1860D-15 of the Act authorize the Secretary to collect any information he needs to carry out that section. However, those subsections also state that “information disclosed or obtained under [section 1860D-15 of the Act] may be used by officers, employees, and contractors of the Department of Health and Human Services only for the purposes of, and to the extent necessary in, carrying out [section 1860D-15 of the Act].” (Sections 1860D-15(d)(2)(B) and (f)(2) of the Act).

In the January 28, 2005 Medicare prescription drug benefit final rule (70 FR 4399), we stated that the section 1860D-15 of the Act restriction applies only in cases where section 1860D-15 of the Act is the authority for collecting the information. When information is collected under an independent authority (even if the collected information duplicates the data collected under section 1860D-15 of the Act) the restrictions under 1860D-15 of the Act would not apply. In the January 28, 2005 final rule (70 FR 4399), we noted that because quality improvement organizations (QIOs) have independent authority to collect Part D claims data in order to evaluate the quality of services provided by Part D sponsors, QIOs would not be barred from collecting such data despite the restrictions of section 1860D-15 of the Act. We refer readers to the October 18, 2006 proposed rule for the exact citation to the discussion in the January 28, 2005 final rule (71 FR 61447). Similar to the statutory provisions authorizing QIOs to collect the information they need to perform their statutory duties, section 1860D-12(b)(3)(D) of the Act recognizes that the Secretary will need to collect a broad array of data in order to properly carry out his responsibilities as head of the Department of Health and Human Services (DHHS). Thus, if the Secretary determines it is necessary and appropriate under section 1860D-12 of the Act for him to collect Part D claims data in order to carry out responsibilities outside section 1860D-15 of the Act, then section 1860D-15 of the Act would not serve as an impediment to such collections.

As stated in the October 18, 2006 proposed rule, we also believe that language in sections 1860D-12(b)(3)(D) and 1857(e)(1) of the Act indicating that the authority to collect information exists only “except as otherwise provided,” and in a manner that is “not inconsistent with this Part,” would not serve as a hindrance to the independent collection of Part D claims data, since on its face, section 1860D-15 of the Act restricts use of information only when collected under that authority.

As we stated in the proposed rule, the Congress most likely included the broad grant of authority in section 1860D-15 of the Act in order to ensure that the Secretary, without engaging in any rulemaking, would have the legislative authority to collect any necessary data in order to pay Part D sponsors correctly. However, we do not believe that the Congress intended to restrict the Secretary when the Secretary otherwise has independent authority to collect identical information to that collected under section 1860D-15 of the Act. Rather, we noted that the Secretary will need to evaluate Part D claims information in order to determine how access to Part D drug benefits affects beneficiary utilization of services under Parts A and B of the Medicare program. Specifically, when Congress enacted the MMA, one of the stated reasons was to ensure that “by lowering the cost of critical prescription drugs, seniors will better be able to manage their health care, and ultimately live longer, healthier lives.” (Press Release, House Ways and Means Committee, Seniors Wait for Affordable Rx Drugs Comes to an End. President Bush Signs Historic Medicare Bill into Law (December 8, 2003) (available at http://waysandmeans.house.gov/​news.asp )). In order to determine whether lowering the costs of prescription drugs actually reduces health expenditures or improves health outcomes for beneficiaries, the Secretary will need to match individual level Parts A and B data with Part D claims data. In this way, the Secretary will be able to evaluate the effectiveness and efficiency of the Part D benefit and report to the Congress and others on the progress of the program.

We are required to report to the Congress regarding whether mandated disease management demonstrations are budget neutral and whether beneficiaries in these demonstrations are on the appropriate medications. As we stated in the preamble of the proposed rule we may also need to make reports under the Part D program, for example, the publication of statistics detailing aggregate Medicare and beneficiary spending by class of drug, average number of drugs used by beneficiaries, total Medicare program spending, and other similar statistics. In order to derive such statistics, we would need to use Part D claims data. In the proposed rule, as well as in this final rule, we outlined a wide variety of situations in which it will be “necessary and appropriate” for CMS to evaluate the same information collected under section 1860D-15 of the Act, even though such information would not be used to implement section 1860D-15 of the Act. In these situations, we believe the clear language of section 1860D-12(b)(3)(D) of the Act provides the authority to collect the necessary information, and nothing about such collection will be inconsistent or in conflict with any other part of the statute.

In addition, as discussed in this preamble, we are adding section 1106 of the Act as a statutory basis for this final rule, as that section authorizes release of data by the agency through regulation.

Comment: Some commenters stated that the proposed rule was inconsistent with the statute. Commenters also asserted that the collection is neither necessary nor appropriate, and some contended that the rule would improperly allow the release of proprietary data.

Response: We refer readers to our discussion of the statutory basis in both the proposed rule (71 FR 61446) and in section II.A.1. of this final rule. As noted in the proposed rule, section 1860D-12(b)(3)(D) of the Act (and its incorporation of section 1857(e)(1)) of the Act provide broad authority to the Secretary to require Part D sponsors to provide the Secretary with “such information as the Secretary may find necessary and appropriate.” In addition, sections 1860D-15(d)(2)(B) and (f)(2) of the Act, by their own terms, restrict information only when “disclosed or obtained under the provisions of [section 1860D-15 of the Act].” Thus, we continue to believe that when information is collected through a statutory authority independent of section 1860D-15 (such as in the case of QIOs, who have independent authority to collect data) the restrictions of section 1860D-15 of the Act would not apply, and nothing about the collection or use of the claims data would create an inconsistency or conflict in the statute.

We also believe the collection of claims data under section 1860D-12 of the Act is both necessary and appropriate for the reasons discussed in the proposed rule and in this final rule. For example, the collection of such claims data will permit the Secretary to conduct high level, internal analyses of the Part D benefit, such as which drugs are commonly used by the Medicare population, the utilization of generic drugs in the Part D benefit, the effect of benefit design on catastrophic costs (costs for which reinsurance is available), the number of individuals who entered the catastrophic phase of the benefit, and many more types of analysis. Similarly, the Secretary will have the opportunity to crosswalk Part D claims data to Parts A and B data in order to analyze the effect of access to prescription drugs on utilization under hospital and supplementary medical insurance.

We know that one of the stated reasons for the drug benefit was to modernize Medicare and ensure that beneficiaries were not enduring unnecessary hospitalizations due to failure to access preventive prescription drug regimens. At the time the prescription drug benefit was being enacted into law, then-chairman of the Senate Finance Committee, Senator Charles Grassley, stated:

[T]his bill is about enhancing quality of life * * *. Today, the practice of medicine—and a lot of the thanks can go to prescription drugs—is to keep people out of hospitals and out of operating rooms. So people who cannot afford drugs, who go to the doctor very sick, are going to not only end up in a place they do not want to go, because people would rather not go to hospitals, rather not go to operating rooms. It is going to save our programs a lot of money, both private and public payment programs, for doctors and hospitals, when we can have people go into programs where they can get prescription drugs and keep their health up so they do not go to the hospital.

(Medicare Prescription Drug, Improvement, and Modernization Act of 2003—Conference Report, 149 Cong. Rec. S15882-03, *S15883 and S15884 (November, 25, 2003)).

Access to Parts A, B, and D claims data will allow the Secretary to analyze the prescription drug utilization of chronically ill patients over time, and determine whether increases in prescription drug utilization do, in fact, result in fewer hospitalizations. This is the type of analysis we believe the Congress expected the Secretary to engage in, and such analysis is both necessary and appropriate under the law.

Finally, in response to concerns about releasing proprietary data to external entities as a result of this rulemaking, we note that data which could affect Medicare program spending, such as rebates, bids, reinsurance, and risk-sharing data, are not part of this rulemaking. In addition, as discussed later in this preamble, this rulemaking places certain limitations on data when released outside of CMS. We believe that it is in the interest of public health to share information collected under the regulations promulgated by this rule with entities outside of CMS for legitimate research, or in cases of other governmental agencies, for purposes consistent with their mission. Through the application of our “minimum data necessary policy”, with some additional restrictions to protect beneficiary confidentiality and commercially sensitive data of Part D sponsors, and our data sharing procedures (which ensure the agency's compliance with the Health Insurance Portability and Accountability Act of 1996 (HIPAA), the Privacy Act of 1974, and other applicable laws), we will limit the use and disclosure of Part D claims data to ensure that the data are only used or disclosed as permitted or required by applicable law, and not inappropriately disclosed in a manner which could undermine the competitive nature of the Part D program.

Comment: One commenter requested that CMS postpone implementation of this regulation until the Congress clarifies CMS's statutory authority and that CMS answer certain questions in a second posting for comment.

Response: We believe we have the authority to collect Part D claims data under sections 1860D-12 and 1860D-15 of the Act, and to disclose Part D claims data collected under section 1860D-12 of the Act, in accordance with section 1106 of the Act. This final rule is sufficiently related to the proposals in the proposed rule, which were the subject of vigorous review and comment by the public, and we are not posting the proposal for a second round of comments.

Comment: One commenter questioned why we were equating collecting data with accessing data.

Response: As stated in both the proposed rule and this final rule, in order to ensure that Part D sponsors are not required to submit a second set of the same data already collected under section 1860D-15, we would collect the data that are the subject of this final rule by extracting them from Part D claims data already collected for payment purposes. This is the same approach we used when we discussed QIO access to data in the January 28, 2005 Part D final rule (70 FR 4399), where we stated that “to the extent QIOs need access to data from the transactions between pharmacies and Part D sponsors, these data could be extracted from the claims data submitted to us”. Thus, in the preamble to this final rule, as in the preamble to the proposed rule (71 FR 61447), we may refer to “accessing” rather than “collecting” Part D data.

2. Information To Be Collected

In the proposed rule, we proposed to independently collect the same claims information collected under section 1860D-15 of the Act under the authority of section 1860D-12(b)(3)(D) of the Act. The Part D claims data for 2006 and 2007 includes 37 data elements. We referred readers to the Prescription Drug Event data instructions which can be accessed at http://www.cms.hhs.gov/​DrugCoverageClaimsData/​01_​PDEGuidance.asp#TopOfPage for a full description of this information.

These instructions define each data element and its specific potential use for CMS's payment process. Generally stated, these data elements include the following:

• Identification of the Part D sponsor and Part D plan through contract number and plan benefit package identification number.
• Health insurance claim number, which identifies the particular beneficiary receiving the prescription.
• Patient date of birth and gender.
• Date of service.
• Date paid by the plan.
• Identification of pharmacy where the prescription was filled.
• Identification of prescribing health care professional.
• Identification of dispensed product using national drug code (NDC) number.
• Indication of whether drug was compounded or mixed.
• Indication of prescriber's instruction regarding substitution of generic equivalents or order to “dispense as written.”
• Quantity dispensed (for example, number of tablets, grams, milliliters, or other unit).
• Days supply.
• Fill number.
• Dispensing status and whether the full quantity is dispensed at one time, or the quantity is partially filled.
• Identification of coverage status, such as whether the product dispensed is covered under the plan benefit package or under Part D or both. This code also identifies whether the drug is being covered as part of a Part D supplemental benefit.
• Indication of whether unique pricing rules apply, for example because of an out-of-network or Medicare as Secondary Payer services.
• Indication of whether beneficiary has reached the annual out-of-pocket threshold, which triggers reduced beneficiary cost-sharing and reinsurance subsidy.
• Ingredient cost of the product dispensed.
• Dispensing fee paid to pharmacy.
• Sales tax.
• For covered Part D drugs, the amount of gross drug costs that are both below and above the annual out-of-pocket threshold.
• Amount paid by patient and not reimbursed by a third party (such as copayments, coinsurance, or deductibles).
• Amount of third party payment that would count toward a beneficiary's true out-of-pocket (TrOOP) costs in meeting the annual out-of-pocket threshold, such as payments on behalf of a beneficiary by a qualifying State Pharmaceutical Assistance Program (SPAP).
• Low income cost sharing subsidy amount (if any).
• Reduction in patient liability due to non-TrOOP-eligible payers paying on behalf of the beneficiary. This would exclude payers whose payments count toward a beneficiary's true out of pocket costs, such as SPAPs.
• Amounts paid by the plan for basic prescription drug coverage and amounts paid by plan for benefits beyond basic prescription drug coverage.

In 2008, the number of elements collected in the Part D claims data was expanded from 37 to 39. Specifically, we added additional elements to reflect the estimated rebate amount applied to the point-of-sale price and the vaccine administration fee. Because these elements were added for 2008, they were not addressed in the October 18, 2006 proposed rule. Furthermore, in the October 2006 proposed rule (71 FR 61447), we did not explicitly discuss how we would respond to future changes in the elements collected as part of the claim. Rather, the proposed rule included only a discussion of the 37 elements that then comprised the Part D claim and proposed that we would collect these 37 elements under section 1860D-12(b)(3)(D) of the Act. As a result, interested parties had an opportunity to comment only upon our proposal to collect the original 37 elements of the Part D claim under section 1860D-12(b)(3)(D) of the Act, and there has not been any similar opportunity for interested parties to submit comments on whether the two new elements should also be collected under section 1860D-12(b)(3)(D) of the Act, such that they may also be used for non-payment-related purposes. Accordingly, we will not be collecting these two data elements under section 1860-12(b)(3)(D) of the Act at this time. We are finalizing a regulation establishing our authority to collect under section 1860D-12(b)(3)(D) of the Act only those 37 data elements that were part of the prescription drug event (PDE) record in 2006. Data regarding these 37 elements may be used for both payment-related and nonpayment-related purposes. As discussed later in this preamble, such use will be subject to our minimum necessary data policy, our data sharing procedures, and the encryption of certain identifiers and aggregation of cost data to protect beneficiary confidentiality and commercially sensitive data of Part D sponsors. Because data regarding the 38th and 39th elements will continue to be collected only under section 1860D-15(d)(2) and (f)(1) of the Act, consistent with § 423.322(b), these data may be used only for payment-related purposes.

We note that this final rule does not extend to rebate or other price concession data, otherwise known as “direct or indirect remuneration” or “DIR”, with the exception of DIR that may be reflected in the negotiated price paid for a drug at the point of sale. Again, the collection of Part D data under the authority of section 1860D-12 of the Act in accordance with this final rule, is limited to the original 37 data elements collected as part of the Part D claims data. We have clarified this in response to comments and in the regulatory text.

Comment: Commenters were generally supportive of CMS's proposal to access Part D claims data for research and non-research purposes, and agreed that the data will provide valuable information and be essential in the evaluation of the Part D benefit. Several commenters requested additional elements be added to the original 37 PDE elements outlined in the proposed rule.

Response: We agree that the PDE data elements we now collect will provide a valuable tool for evaluating the Part D program, and appreciate the suggestions to add other elements for collection. This final rule is first and foremost a clarification of the statutory authority that allows us to collect the original 37 PDE elements outlined in the proposed rule and this final rule and to access them for purposes other than payment. Since these data are already being collected under the Part D program, we would access the already-collected data and make them available for research and non-research purposes, without undue burden to Part D sponsors or beneficiaries.

As discussed above, in 2008, the number of PDE data elements was expanded to 39. In future years, we may revise our guidance on PDE Reporting to include additional elements on the claim beyond the elements presently collected. Through separate rulemaking, we will address whether we intend to collect any of these additional elements under our authority in section 1860D-12(b)(3)(D) of the Act.

Comment: Several commenters noted that the proposed rule relates to drug claims and related information and asked for clarification as to what is meant by this phrase. A few commenters noted that the presence of this phrase in the proposed regulatory text suggests that CMS may be contemplating using and sharing rebate and other discount and pricing concession data.

Response: Rebate and other price concession data are not the subject of this final rule. This rulemaking applies to Part D claims data only, and is limited to the original 37 elements reported on the PDE. To further clarify this point we are amending proposed § 423.505(f)(3) to delete the applicable reference to “related information.”

Comment: Several commenters expressed concern about access to cost and pricing data. Several commenters noted that pricing data contained on the Part D claim are not an accurate reflection of the actual costs to plans. These commenters also requested clarification that the information we are proposing to collect and disclose relate only to Part D claims data, and not to competitively sensitive financial data regarding rebates, discounts or other negotiated price concessions. The commenters expressed a concern that release of competitively sensitive data could undermine the competitive bid process. They assert that plans will be able to adjust their bids on the basis of knowledge of each others' data, resulting in higher drug costs for all.

Response: We share the commenters concerns about the need to protect the sensitive data under the Part D program. Because the Medicare drug benefit is based on a competitive business model, to release commercially or financially sensitive data to the public could negatively impact Part D sponsors' ability to negotiate for better prices, and ultimately affect the ability of sponsors to hold down prices for beneficiaries and taxpayers. Therefore, we have adopted a number of protections to mitigate these concerns.

First, we have clarified that this final rule applies only to the 37 original elements of Part D claims data and not to rebate and other price concessions data. As discussed above, to the extent that the PDE record was amended in 2008 to include data on estimated rebates applied at the point of sale, we have clarified it in the regulation that we will not be collecting this information under that authority. In addition, we note that plan-specific bid information is not included on the claim, and therefore, would not be the subject of this rulemaking.

Second, with respect to our disclosures of information collected under this rulemaking to external entities, we have developed an approach to minimize the risk of unauthorized disclosure of beneficiary identifiable information, as well as the use of commercially sensitive data of Part D sponsors. Similar to the process used under Parts A and B program:

• We will require research using beneficiary identifiable data to be conducted by an experienced entity at a reputable organization, with an appropriate research design, and with assurances to protect beneficiary confidentiality. Research is to be made available to the public and identifiable data is not released for commercial purposes.
• We will only release beneficiary identifiable data for research purposes if the CMS privacy board approves the data release and then, will only release the minimum data necessary for the study.
• Requesters who receive identifiers to link to another dataset will be required to re-encrypt beneficiary identifiers, after data linkage, to minimize the risk of accidental disclosure.
• Requesters will sign a data use agreement which carries penalties for misuse or intentional release of beneficiary identifiable information.

In addition to these protections of beneficiary identifiable information, we plan to impose additional restrictions to further protect beneficiary confidentiality and plan commercially sensitive information. When releasing data to external entities, we will restrict releases according to the following principles:

• Only the minimum necessary elements from the PDE will be released for a project. In accordance with this principle, cost data will not be released unless necessary for the project.
• Drug cost elements (that is, ingredient cost, dispensing fee, and sales tax) will be aggregated.
• Beneficiary identifiers, pharmacy identifiers and prescriber identifiers will be encrypted where not needed to link to other datasets. Additionally, an element representing the internal prescription service reference number assigned by pharmacies will not be released so as to not indirectly reveal pharmacy identifiers.
• Plan identifiers will always be encrypted for external entities. We note that the internal plan identification numbers on the claim would also not be available to external entities as these represent reference numbers assigned by the plan at the time a drug is dispensed and release of such numbers could lead to a de facto identification of the plan. We also note that when we state in this preamble that an identifier will be encrypted, this means that it will be replaced with a non-identifiable number or code such that there is a low probability of assigning any meaning to the replacement number or code. Unless otherwise noted, encryption will occur without any decryption, and we would not provide a key that allows for an encrypted identifier to be converted back into its original form. We believe these restrictions will protect both the commercially sensitive data of Part D plans, such as the plan identifiers, pharmacy identifiers, prescriber identifiers and cost elements, as well as the beneficiary identifiable data included on the claim. Similar protections for both beneficiary identifiable information as well as commercially sensitive data of Part D sponsors will be in place for releases to governmental entities as well including States, Congress and other executive branch agencies. For both States and non-HHS executive branch agencies, the drug cost elements on the claim (ingredient cost, dispensing fee, and sales tax) will be aggregated together, and will not be available in a disaggregated format, except that, upon request, CMS will exclude sales tax from the aggregation at the individual claim level if necessary for the project. We believe this aggregation will serve to ensure that some of the most confidential data on the claim—the separate costs paid by Part D sponsors for ingredient cost or dispensing fee—will not be vulnerable to any unauthorized release. However, because these government agencies may need other data on the claim in order to coordinate treatment of beneficiaries or further study care received by individual beneficiaries, we will make the beneficiary, plan, pharmacy, and prescriber identifiers available to these entities where needed. For example, as discussed later in this preamble, States have specifically requested claims data for beneficiaries dually eligible for Medicaid and Medicare. By understanding the care received by these beneficiaries, the State Medicaid agencies may be able to better coordinate the medical costs they reimburse under Medicaid with the drug regimens being reimbursed under the Medicare Part D program. In coordinating care, these State agencies may need to understand which plan a beneficiary is enrolled in. Releases to Congressional oversight agencies are discussed in response to comment later in this preamble. We have included these restrictions in our amended regulations at § 423.505(m).

The appendix to this rule also contains a CMS chart, explaining in more specific detail the restrictions relative to the available PDE elements for various parties. We will evaluate all requests for these data to ensure that any release is consistent with the restrictions contained in our regulations, and we will release only the minimum data that are necessary for the specific project. Additionally, as part of our data sharing procedures, we will ensure that any disclosure is for an appropriate purpose and does not undermine the competitive nature of the Part D program, such as a disclosure that would result in Part D sponsors being able to adjust their plan bids on the basis of knowledge of each others' data.

Finally, while we agree with commenters that cost data on the Part D claim may not reflect the actual costs to plans, such data does reflect costs incurred at point-of-sale, and may be of use to CMS, other governmental entities, and other external entities for projects unrelated to a plan's total costs.

Comment: One commenter asked that CMS appropriately use and differentiate between the terms “sex” and “gender” in its data collection process.

Response: The Patient Gender Code field in the Part D claim is defined by the National Council of Prescription Drug Programs (NCPDP). We have found it helpful in working with the industry and other stakeholders to rely on the NCPDP industry standard whenever possible. The NCPDP data dictionary defines “Gender Code” under definition of field, “For eligibility, and identifying the gender of the member.” Values are: M=Male, F=Female, and U=Unknown.

B. Purpose of CMS Collecting Information

In the proposed rule, we outlined our intended use of Part D claims data for a wide variety of statutory and other purposes including—

• Reporting to the Congress and the public on the overall statistics associated with the operation of the Medicare prescription drug benefit;
• Conducting evaluations of the Medicare program;
• Making legislative proposals with respect to the programs we administer, including the Medicare, Medicaid, and the State Children's Health Insurance Program; and
• Conducting demonstration projects and making recommendations for improving the economy, efficiency, or effectiveness of the Medicare program.

In the final rule, we continue to believe such uses are necessary and appropriate. In addition, as discussed below and later in this preamble, we also intend to use these data for “other studies addressing public health questions,” “pilot projects,” “supporting quality improvement and performance measurement activities,” and “populating personal health records,” and have added these purposes to the list in § 423.505(f)(3).

Comment: Many commenters believe analyses of Part D claims data are necessary for CMS to administer the Medicare program, and for planning, evaluation, and policy development. Examples of program research and evaluation uses suggested by commenters include—

• Assuring that Part D has not promoted adverse selection into certain health plans with less generous medication coverage;
• Examining the effects of drug coverage and cost containment on Medicare spending and the health of vulnerable elderly and disabled persons;
• Measuring the success of prescription drug plans in encouraging the use of generic medicines;
• Examining the transition effects of moving dual eligibles from Medicaid programs to Part D;
• Analyzing the effects of a coverage gap on drug utilization and spending;
• Determining the impact of Part D coverage on non-pharmaceutical treatments and services use;
• Evaluating the effect of changing copayments, copay structures, and coverage limits on beneficiary drug choices and compliance with drug regimens;
• Assessing the extent to which risk adjustment methodology influences enrollment dynamics;
• Assessing the impact of adding a prescription drug benefit on health outcomes of beneficiaries;
• Researching the extent to which disparities in care (based on race, socioeconomic status, rural residence, etc.) might be affected by Part D; and
• Understanding the impact of Part D on related public programs, such as the State Children's Health Insurance Program (SCHIP), SPAPs, Medicaid, and the VA.

Commenters also noted that being able to explore how Part D functions on its own and in relation to other parts of the Medicare program is essential to guiding future policy decisions. They further assert that use of Part D claims data is critical to CMS's credibility and should be considered as part of the Secretary's value-based health care purchasing initiative. Without access to Part D claims data for research and other purposes, CMS will limit its ability to monitor expenditures for the new program, to study the impact of the program on public health, and to respond to Congressional requests for information.

Response: We agree with the many comments that Part D claims data will be essential to us for reporting, conducting program evaluations and demonstrations, research analyses, and other public health functions. We also agree that research uses of these data should help promote and protect the health and well-being of Medicare beneficiaries. While we believe these uses were implied in the regulatory text set forth in the proposed rule, we are expanding the list of necessary and appropriate purposes for which data will be collected in this final rule to address public health functions specifically.

Comment: Commenters expressed widespread support for using Part D claims data to improve our knowledge base on medication adherence and other aspects of pharmacotherapy among the elderly and disabled. Some specific suggested uses of Part D claims data for this purpose include the following:

• Describing current medication use among the elderly and disabled and examining trends, specifically enhancing our awareness of poly-pharmacy, off-label uses, avoidance of contraindicated drugs and dangerous drug-drug interactions.
• Examining the extent to which Medicare beneficiaries receive medicines according to evidence based guidelines.
• Assessing whether beneficiaries are adhering to prescribed therapy, and if not, the clinical and economic impact of nonadherence.
• Testing new interventions to improve medication prescribing and adherence.
• Evaluating the impact of medication therapy management programs mandated under the new Medicare prescription drug benefit.

Response: We consider examining medication use, inappropriate use, and factors influencing medication adherence in the Medicare population to be crucial aspects of Part D program monitoring and evaluation, and public health. As noted by commenters, the Congress mandated that we examine best practices of medication therapy management, and Part D claims data are critical for our being able to complete that study.

Comment: A few commenters noted that sharing of research results is critical to CMS credibility and should be considered part of the transparency initiative.

Response: We recognize Part D claims data research, and any subsequent results, are critical to evaluating multiple aspects of the Medicare Prescription Drug program. Many quality measures developed by the American Medical Association Physician Consortium and National Committee for Quality Assurance, and subsequently adopted by Ambulatory Care Quality Alliance, and the Hospital Quality Alliance require Part D claims data to run the measures. All of the following quality measures involve Part D claims data: Drug Therapy for Lowering Cholesterol, Beta-Blocker Therapy within 7 days post myocardial infarction, and Beta-Blocker therapy at 6 months post myocardial infarction. These measures will be used by many of the Better Quality Information to Improve Care for Medicare Beneficiaries Project pilots, including the new local collaboratives being chartered under the Secretary's value-based health care initiative to foster public reporting. All of this makes Part D claims data an integral part of our transparency efforts. Thus, in this final rule, we are clarifying our intent to use Part D data for these necessary and appropriate purposes by adding “supporting quality improvement and performance measurement activities” as an explicit use of these data under § 423.505(f)(3).

Comment: A commenter asserts that we did not adequately justify the use of Part D claims data by the Secretary for public reporting purposes, apart from its use to develop reports to the Congress, which may become publicly available records.

Response: As we stated in the proposed rule, we believe it is appropriate and necessary for the Secretary to use Part D claims data for the purposes of reporting to the Congress on the effectiveness and performance of the prescription drug benefit—including reporting that is not related to payment. In addition, we may need Part D claims data to report to the public on aggregate statistics associated with the Part D program. Finally, the Secretary has determined that it is necessary and appropriate, under section 1860D-12 of the Act, that the public should have access to certain data, so that the public may monitor the progress of the Part D program and, in fact, perform research that will improve the health of, not only Medicare beneficiaries, but all Americans. This is why we have created Part D-related public use files relating to plan benefits and formularies (for example, files such as geographic locator files, plan information files, formulary files, beneficiary cost files, pharmacy network files, and record layout files as described at http://www.cms.hhs.gov/​NonIdentifiableDataFiles/​09_​PrescriptionDrugPlanFormularyandPharmacyNetworkFiles.asp.). We may also create additional public use files subsequent to the publication of this final rule.

Comment: Several commenters suggested that the reporting of overall statistics and development of evaluations and/or legislative proposals can be achieved without CMS having to use or disclose the Part D sponsors' Part D claims data. The commenter suggested that CMS use information that is separately collected from the claim to develop statistics, noting however, that this information will not necessarily allow CMS to do every type of analysis described in the proposed rule. Additionally, CMS could partner with one or more sponsors to use their data, alone, or in combination, to do additional statistics and analysis.

Response: Although we are willing to partner with plan sponsors as needed, we do not believe that voluntary cooperation by Part D sponsors would provide the kind of comprehensive data sets we need to perform the research, evaluations, reporting and other functions that are described this final rule. Voluntary agreements with plan sponsors would lead to an incomplete file of data. In addition, because we possess the authority under section 1860D-12(b)(3)(D) of the Act to collect Part D claims data, we do not believe an exclusive reliance on such voluntary agreements is necessary.

Comment: A commenter noted that a recent Report to Congress recommended that the Secretary should have a process in place for the timely delivery of Part D data to congressional support agencies to enable them to report to the Congress on the drug benefit's impact on cost, quality, and access.

Response: We agree that congressional support agencies should have timely access to appropriate Part D data. This final rule allows congressional oversight agencies access to all elements on the Part D claim in order to carry out their functions. Like other agencies outside of CMS, such congressional agencies would be subject to our minimum necessary policies and data sharing policies. Thus, we would release only the minimum amount of Part D claims information necessary to support given projects. In addition, as discussed later in this preamble, the Congressional Research Service has the authority to require data releases only when acting on behalf of a committee. Thus, that agency would be treated the same as a congressional oversight agency when acting on behalf of committee. Otherwise, it would be subject to the same restrictions that apply to external entities in our regulation.

Comment: Several commenters requested that we establish specific, explicit procedures to ensure that if comparative effectiveness or safety research informs coverage or payment decisions for specific items and services (whether decisions are made by CMS or its agents under Parts A and B or by private plans under Part D), stakeholders have an opportunity to evaluate the evidentiary basis of proposed decisions and provide input.

Response: Since our proposed rule did not address the development of national coverage or payment decisions, but rather our access to Part D claims data, we believe that our development of coverage or payment decisions is beyond the scope of this rulemaking. We do note that section 1860D-4(b)(3) of the Act requires pharmacy and therapeutic committees to base clinical formulary decisions on the strength of the scientific evidence and standards of practice. We have issued further formulary guidance available at http://www.cms.hhs.gov/​Pharmacy/​07_​Formulary%20Guidance.asp#TopOfPage.

Comment: Some commenters noted potential uses for Part D claims data, linked with Parts A and B data, which extend beyond research into the actual provision of care, including disease management.

Response: We believe the implementation of disease management programs and the evaluation of these programs could potentially be strengthened by the use of Part D claims data. However, we believe these data must be used with caution for these purposes since we collect Part D claims data only for Medicare Part D enrollees. We do not collect drug claims data for those beneficiaries who receive their drug insurance solely from other sources, such as employer or retiree sponsored health plans, the Veterans Health Administration, or TRICARE.

Comment: Some commenters noted that Part D claims data can help improve Medicare's current basis of risk adjustment for plan payments.

Response: Section 1860D-15(d)(2)(B) of the Act provides us authority to use Part D claims data for determining Medicare payments to prescription drug plan sponsors. This includes their use for refining our drug plan payment system. Thus, when claims data are used for risk adjustment they are collected under section 1860D-15 of the Act, and not under section 1860D-12 of the Act.

Comment: A commenter recommended adding the phrase “and pilot” into the text of the § 423.505(f)(3)(iv), so that the regulation would read “The Part D plan sponsor agrees to submit to CMS * * * [d]ata included in drug claims submitted by Part D plan sponsors, as the Secretary deems necessary and appropriate for purposes including but not limited to * * * [(f)(3)(iv) c]onducting demonstration and pilot projects and making recommendations for improving the economy, efficiency, or effectiveness of the Medicare program.” The commenter wants to ensure that Medicare Health Support Organizations are able to access Part D claims utilization data.

Response: We agree that pilot projects, as appropriate, should have access to these data, as appropriate, and have added the phrase “and pilot” to § 423.505(f)(3)(iv).

Comment: Several commenters requested that the list of purposes for which the data would be used be expanded to include program integrity.

Response: We agree that it is important that our program integrity components have access to necessary data in order to protect the program. The existing regulation at § 423.322(b) already allows information collected under section 1860D-15 of the Act to be used in determinations of payments and payment-related oversight and program integrity activities. To the extent that program integrity activities may include investigations of issues that are not directly payment-related, this rule will provide access to Part D claims data for these purposes.

Comment: One commenter requested we clarify in the final rule that Part D claims data can be used by CMS to oversee and protect the program. Other commenters stated that we should clarify that Medicare Drug Integrity Contractors (MEDICs) can obtain Part D claims data where necessary to fully investigate complaints and fraudulent claims.

Response: Our regulations already address use of payment data for payment-related oversight. We are constantly working with our MEDICs to determine the types of data to which they will have access. However, we believe our interactions with our contractors involve internal agency procedures, and are not the subject of this final rule.

C. Sharing Data With Entities Outside of CMS (Final § 423.505(f)(3) and (l) Through (o))

As stated in the October 18, 2006 proposed rule, in addition to collecting Part D claims data for use in administering the Medicare Part D program under the authority of section 1860D-12(b)(3)(D) of the Act, we also believe that it is in the interest of public health to share the information collected under that authority with entities outside of CMS. When information is collected under the authority of section 1860D-12(b)(3)(D) of the Act, we do not believe that the statutory language in section 1860D-15(d) and (f) of the Act (requiring the information collected under the authority of that section to be used only in implementing such section) would apply, since any collection would be effectuated outside of section 1860D-15 of the Act. Therefore, as we stated in the October 18, 2006 proposed rule, we proposed to add a new § 423.505(f)(5) to the regulations (now § 423.505(l) and (m)) that would specify that we could use and share the Part D claims information we collect under § 423.505(f)(3), without regard to any restriction included in § 423.322(b). In response to comments, we clarify in this final rule that our regulation permitting release of Part D claims data to other government agencies and outside entities is authorized by section 1106 of the Act.

1. Other Government Agencies

We stated in the proposed rule that the Department of Health and Human Services’ (DHHS') public health agencies such as the National Institutes of Health (NIH), the Food and Drug Administration (FDA), and the Agency for Healthcare Research and Quality (AHRQ) have, or support, researchers that would need to use Medicare Part D prescription drug event data for studies, and other projects, to improve public health consistent with the missions of these agencies. We also stated that oversight agencies may need access to both aggregated and non-aggregated claims data in order to conduct evaluations of the Part D program that are unrelated to payment and therefore not authorized under section 1860D-15 of the Act. In addition, agencies in the legislative branch, such as the GAO, MedPAC, and CBO, may need access to data in order to evaluate the program. We continue to believe this.

We also continue to believe that other agencies within DHHS, such as the Centers for Disease Control and Prevention, the Health Resources and Services Administration, or the Office of the Assistant Secretary for Planning and Evaluation, may also need Part D claims data to perform evaluations or assess policies. However, we note specifically that OIG has independent authority to collect Part D claims data from Part D sponsors to perform its statutory duties in accordance with the Inspector General Act of 1978, as amended, 5 U.S.C. App. This final rule provides OIG an additional avenue for access to these data for both payment and nonpayment purposes.

Given these necessities, we proposed to allow broad access for other Federal government executive branch agencies to our Part D claims data, linked to our other claims data files. As stated in the preamble of the proposed rule, other agencies generally would enter into a data sharing agreement, similar to what is used today. This would allow the sharing of event level cost data, protect the confidentiality of beneficiary information, and ensure that the use of Part D claims data serves a legitimate purpose. We also stated in the proposed rule that we would also ensure that any system of records with respect to Part D claims data is updated to reflect the most current uses of such data.

In the proposed rule, we requested comments that would help us in our efforts to improve knowledge relevant to the public health. Specifically, we requested guidance on how we can best serve the needs of other agencies through the sharing of information we collect under section 1860D-12(b)(3)(D) of the Act, while at the same time addressing the legitimate concerns of the public and of Part D plan sponsors that we appropriately guard against the potential misuse of data in ways that would undermine protections put in place to ensure confidentiality of beneficiary information, and the nondisclosure of proprietary data submitted by Part D plans.

After considering the comments received, we will make Part D claims data available under a process that builds upon the practice that is currently in place today with respect to the release of Medicare Parts A and B data. Thus, we specify in this final rule that, of the data we collect under the authority of section 1860D-12 of the Act, only the minimum information necessary, subject, in certain cases, to encryption and aggregation of certain elements, will be shared with other Federal executive branch agencies, which would include contractors acting on their behalf, in accordance with section 1106 of the Act, based on data sharing procedures established by CMS and agreed to by the Federal executive branch agency requesting the data. The attached appendix, as well as our amended rules at § 423.505(m), explain how in this final rule we would group the governmental entities outside of CMS that request access to the data collected under 1860D-12 of the Act. Agencies within HHS, as well as the Congressional oversight agencies (including CRS when acting on behalf of a committee) would receive only the elements of the PDEs on the claim that are minimally necessary for the applicable project. Plan, pharmacy, and prescriber identifiers would be encrypted unless necessary for the project. In addition, for States and non-HHS executive branches, the dispensing fee, ingredient cost and sales tax elements on the claim would be aggregated together prior to any release, except that, upon request, we will exclude sales tax from the aggregation at the individual claim level if necessary.

Comment: One commenter objected to the use of the word “necessities,” stating that it is not necessary to allow broad access to Part D claims data.

Response: We continue to believe that it is both necessary and appropriate for the Secretary to collect the Part D claims data under section 1860D-12(b)(3)(D) of the Act in order to carry out his broad range of duties under the Act, including the duties that are listed at § 423.505(f)(3). Once the Secretary collects the information for his own necessary and appropriate purposes, we do not believe that the external release of such information must be categorized as necessary in order for it to occur, as section 1860D-12(b)(3)(D) of the Act refers to the collection of, not the release of, data. Release of data will be authorized under section 1106 of the Act. In addition, any release will be intended for the benefit of the public health and welfare.

Comment: Several commenters requested that the FDA play a central role in any use of Part D claims data for safety evaluations. Others requested that CMS issue a separate proposal to present CMS and FDA combined views on sharing of data for public comment. One commenter also contended that the FDA may not want to use Part D claims data because of alleged reliability problems and the fact that the FDA may have problems integrating the Part D claims data with its own databases. Finally, commenters requested that both agencies allow manufacturers to review the data and methods used for post-marketing surveillance.

Response: We do not believe that the FDA's use of Part D claims data or how the claims data are used in safety evaluations is the subject of this proposed rule. However, we note that we plan to exchange Part D claims data with the FDA in accordance with applicable laws and our data sharing procedures, by entering into appropriate interagency agreements and data use agreements. Thus, our procedures for sharing data with the FDA will be the same as those developed for other government agencies.

Comment: A commenter requested that the Congressional Research Service (CRS) be able to access the same level of data as oversight agencies, such as the Office of the Inspector General (OIG), the Government Accountability Office (GAO), the Congressional Budget Office (CBO), and the Medicare Payment Advisory Commission (MedPAC).

Response: In the proposed rule we stated that the Congressional oversight agencies (GAO, MedPAC, and CBO) may require access to data in order to evaluate the Part D program (71 FR 61452). Although we did not define CRS as a Congressional Oversight entity, like GAO, it does have statutory authority to request data (see 2 U.S.C. 166(d)(1)), but only when it is doing so on behalf of a committee. Accordingly, we are specifying that CRS will be considered a congressional oversight agency when the CRS is acting on behalf of committee under 2 U.S.C. 166(d)(1). Our regulations at § 423.505(m), as well as the attached appendix outline the data policies that would apply to congressional oversight agencies, including being subject to our minimum data necessary policy, our data sharing procedures, and applicable laws. For individually identifiable information or certain commercially or financially sensitive information, such as plan identifiers and cost information, these Congressional oversight agencies will be required to sign a Data Use Agreement (or provide assurances acceptable to CMS) to protect against disclosure of such data. When CRS is not acting as the agent of a committee, however, it does not have the same authority to request data from departments or agencies of the United States. Thus, we have specified that in these cases, CRS would be treated as an external entity, because the agency would essentially be performing research or analysis on behalf of an individual member of the congress. In addition, unlike States or other executive branch departments, the CRS should not need access to plan identifiers or other data on the claim in order to coordinate care on behalf of beneficiaries. Thus, we have specified that CRS will be restricted in the same manner as external researchers, and will not be treated similar to other executive branch agencies or States.

Comment: A commenter asked CMS to allow for a process that permits access to Part D claims data in a highly organized way and enables external entities to replicate any results Federal agencies obtain using the data.

Response: We believe that our approach to providing access to Part D claims data, which would follow a review of each request under our minimum necessary data policy with some additional encryption and aggregation restrictions based on type of requestor, balances the need for Part D data in order to conduct legitimate research with the needs to protect patient information and to preserve the competitive nature of the Part D program. Therefore, we will review legitimate research requests and decide whether to release Part D claims information, consistent with our regulation at § 423.505(m), as well as the guidance provided in the appendix to this final rule. We expect that external entities may be able to replicate the results of Federal analyses for many research questions, such as those relating to the utilization of specific drugs or classes of medications, comparative effectiveness or safety research.

Comment: A few commenters asked that all applicable government agencies have broad access to the data in a timely fashion without having to enter into numerous data use agreements (DUA).

Response: As illustrated in our regulation § 423.505(m), as well as in the appendix to this final rule, non DHHS entities will have access to the minimum Part D claims data necessary for a given project, except that certain elements may be encrypted or aggregated. In the event of a backlog of requests for Part D data under these rules, we plan to give government agencies first preference in the review process, and to require such agencies to abide by our data sharing policies, which generally require a data use agreement. We have modified or streamlined the data sharing process in the case of certain Federal law enforcement or oversight entities. For example, we have streamlined the DUA process for the Department of Justice (DOJ). DOJ provides a letter for each request for data, which CMS tracks and monitors.

2. External Entities

As stated in the preamble of the proposed rule, external entities, such as researchers based in universities, regularly request and analyze Medicare data for their research studies, many of which are designed to address questions of clinical importance and policy relevance. We continue to believe researchers studying a broad range of topics need access to Part D claims linked to Parts A and B claims data. As stated in the preamble of the proposed rule, analyses of Parts A and B claims have contributed to significant improvements in the public health, have been critical in assessing the quality and costs of care for patients in the Medicare program, and have, in many cases, spurred other types of research. As such, we continue to believe that a data source that includes Parts A and B claims as well as their attendant Part D claims could be used in a similarly constructive manner, such that greater knowledge on a range of topics, both clinical and economic, would be generated. This knowledge is expected to contribute positively to the evaluation and functioning of the Medicare program, and to improve the clinical care of beneficiaries.

Also, as stated in the preamble of the proposed rule, we will specifically address the needs of a segment of external entities as part of our implementation of section 723 of the MMA, which requires the Secretary to develop a plan to “improve the quality of care and reduce the cost of care for chronically ill Medicare beneficiaries.” The Congress specifically stated that the plan should provide for the collection of data in a data warehouse (under section 723(b)(3) of the MMA). Within the parameters of this regulation, we will implement section 723 of the MMA by populating a chronic care condition data warehouse (CCW) which will be accessible by private researchers in order for such researchers to conduct studies related to improving quality and reducing costs of care for chronically ill Medicare beneficiaries.

In addition to the section 723 of the MMA data warehouse, we stated in the proposed rule that we are planning to make Medicare Part D claims data linked to other Medicare claims files available to external entities on the same terms as other Medicare Parts A and B data are released today, with appropriate protections for beneficiary confidentiality. We requested comments on the proposed use of the data for research purposes that would help us in our efforts to improve knowledge relevant to the public's health, as well as comments on whether we should consider additional regulatory limitations for external entities beyond our existing data use agreement protocols in order to further guard against the potential misuse of data for non-research purposes, commercial purposes, or to ensure that proprietary plan data or confidential beneficiary data are not released.

As explained in response to comments, we continue to maintain the discretion to release the 37 collected PDE elements for legitimate research purposes, subject to encryption of certain identifiers and aggregation of cost data to protect beneficiary confidentiality and commercially sensitive data of Part D sponsors. (These restrictions are outlined in our regulations at § 423.505(m) as well as in the appendix attached to this rule.) Furthermore, we also believe Part D claims data are necessary for use in personal health records and to ensure the public will be able to access the results of quality measurement and performance initiatives as discussed in the “Purpose of CMS Collecting Information” section of this preamble. We will release only the minimum information necessary for a given project. In addition, data will be disseminated in accordance with applicable laws via our established data sharing procedures. Thus, the requestor of data must agree to abide by the restrictions established by our data sharing procedures in order to receive access to Part D claims data. We will ensure that our system of records for Part D claims data would permit the uses of the data described in this final rule.

Comment: In general, the importance of Part D claims data for improving aspects of public health was a recurring theme among many of the comments we received. Commenters noted the lack of a comprehensive source of prescription medication data as one of the greatest challenges to conducting meaningful research in the elderly. They noted that Part D claims data will be vital for enhancing disease surveillance, identifying rare complications of drug therapy, and improving knowledge about the effectiveness and safety of drugs. Several commenters underscored that knowledge based on selected aspects of pharmacotherapy in the elderly or disabled population is limited. They point out that the very old, patients with multiple chronic conditions, and those taking multiple medications are routinely excluded from clinical trials, and assert that research based on Part D claims data would provide a valuable supplement to the FDA's current post-marketing surveillance system.

Other themes raised by commenters centered on the current fragmentation of our health care information and the lack of information on drug treatment in the elderly. These commenters suggested that analyses of Part D claims data linked with Parts A and B data could provide a comprehensive picture of disease treatment, help guard against siloed policy analyses, and support a broad, disease-centered research agenda that would advance the essential quality improvement goals highlighted by the Institute of Medicine in its report, Crossing the Quality Chasm: A New Health System for the 20th Century. Commenters also said analyses of Part D claims data would be beneficial for developing comprehensive estimates of the costs of care, revealing the most cost effective disease therapies, and understanding beneficiaries' sensitivity to changes in cost sharing for drugs.

Response: We agree with the many comments that Part D claims data will be essential for research analyses involving the elderly and disabled, and for other public health functions.

Comment: Two commenters suggested that CMS implement a tiered system of access to Part D claims data. Specifically, they suggested we establish separate tiers for accessing the data, taking into account the need for data and the opportunity for abuse, which would correlate to the following groups: (1) Government agencies; (2) contractors and researchers under contract with CMS or another government agency; and (3) outside researchers. They suggest that Part D claims data be available to the above-listed entities within appropriate parameters, but not be available to entities, such as pharmaceutical manufacturers and others with strong proprietary interests.

Response: We considered several alternatives to the Medicare A/B data release process including restricting:

• Access to HHS agencies only,
• Access to Federal Government agencies only,
• Access to financial elements for outside researchers.

We rejected these alternatives as too restrictive in light of the significant benefits to the Medicare program and the public's health in making Medicare Parts A, B, and D linked data available, with protections, to Federal and State government agencies, and external entities. We believe that our approach, which incorporates the Medicare A/B minimum necessary data policy with additional restrictions to protect privacy and plan commercially sensitive information, strikes an appropriate balance between these significant health benefits and the concerns regarding the release of proprietary data and preserving beneficiary confidentiality. Moreover, we believe this process has sufficient protections to ensure compliance with the applicable laws and guard against the potential misuse of data. External entities requesting access to Part D claims data will have to enter into an agreement with us that includes provisions protecting the data from improper release.

Our regulation at § 423.505(m), as well as the attached appendix provides additional guidance on the additional limitations that would apply to external entities (which would include CRS when not acting on behalf of a committee as an agent, but would not include States or other executive-branch Federal agencies) requesting Part D data. Cost data (consisting of ingredient cost, dispensing fee, and sales tax) could be released only in aggregated form. In addition, plan and other identifiers generally would be encrypted.

We also intend to only release the minimum data necessary for a given project. Additionally, we also note that if an entity involved in a data release of electronic protected health information (EPHI) is a HIPAA-covered entity, the covered entity will have to comply with our HIPAA privacy and security standards. In addition, the covered entity should also follow the security guidance which was released in December 2006. The guidance reinforces our existing security standards to specifically address remote access and use of EPHI. This reinforcement of the HIPAA security standards, particularly related to data in transit, will further protect Part D claims data from inappropriate release, and therefore inappropriate use. For more information on this guidance, please log on to http://www.cms.hhs.gov/​SecurityStandard/​.

Comment: We requested comments on whether we should consider additional regulatory limitations for external researchers beyond our existing data use agreement protocols in order to further guard against the potential misuse of data for non-research purposes, commercial purposes, or to ensure that proprietary plan data or confidential beneficiary data are not released. In response, a number of commenters requested that CMS define the term “commercial purposes” clearly and narrowly so that a broader range of entities would have access to the data, including pharmaceutical manufacturers, insurance companies, and pharmacy benefit managers. These commenters argue that instead of precluding certain types of entities from accessing Part D claims data, it would be better to focus on assuring researcher quality and integrity, and on ensuring that researchers adopt sound methodologies in conducting analyses. Therefore, the commenters request that the “clear bias” against pharmaceutical company supported research be removed from the CMS review criteria.

As noted previously, other commenters suggested that the final regulation should deny access to data to organizations with strong proprietary interests, such as drug plan sponsors, pharmaceutical manufacturers, and other industry data collection entities that sell market research and sales data.

Response: Under our current policies for Parts A and B data, we do not provide protected health information (PHI), as defined for purposes of HIPAA at 45 CFR 160.103, for commercial purposes, as we believe PHI should only be provided to entities conducting research that will result in generalizable knowledge in the public domain. We are concerned about the potential for conflicts of interest where commercial entities, whose primary purpose is not the creation of generalizable knowledge, might not publish results contrary to the firm's financial interest. However, we do allow external researchers to be funded by commercial firms, including pharmaceutical manufacturers, insurance companies, and pharmacy benefit managers when the research will contribute to general knowledge in the public domain and the researchers are free to publish the results of the research regardless of the findings. We continue to believe that any findings based on beneficiary identifiable data released by us should be unbiased by commercial incentives and should be in the public domain. The criteria governing releases of protected health information (PHI) for research are designed to ensure that the HIPAA Privacy Rule's requirements, as defined at 45 CFR 164.512(i), as well as our own policies are met. In this final rule, we use the definition of research contained in the HIPAA Privacy Rule, which defines the term as “a systematic investigation, including research development, testing and evaluation, designed to develop or contribute to generalizable knowledge” (45 CFR 164.501). Thus, we do not release PHI to external entities when their research is not designed to develop or contribute to the generalizable knowledge. Nor do we release PHI to external entities for their commercial purposes or if they fail to demonstrate that they have a sound research methodology and that their research will produce findings relevant to the Medicare program and its beneficiaries.

Therefore, we will continue to apply the same criteria in distinguishing between who may have access to data (researchers versus commercial interests), as we have been using for Parts A and B data. Because we intend to examine whether each proposed use of data meets the definition of research used under the HIPAA Privacy Rule, we will not be defining the term “commercial purposes” in this regulation.

Comment: We received several comments relating to the Freedom of Information Act (FOIA), noting that releases under FOIA should not include information that would be considered proprietary in nature.

Response: If a FOIA request is received, we will follow our ordinary FOIA procedures and not release under FOIA data the agency determines are trade secrets, or commercial or financial information protected by FOIA Exemption 4 (5 U.S.C. 552(b)(4)). These procedures were explained more fully in the preamble to the Part D final rule, where, in response to a question about protecting bid information under FOIA we stated:

[B]idders can always seek to protect their information under the Freedom of Information Act and label truly proprietary information “confidential” or “proprietary”. When information is so labeled, the bidder is required to explain the applicability of the FOIA exemption they are claiming. When there is a request for information that is designated by the submitter as confidential or that could reasonably be considered exempt under Exemption 4, the Department is required by its FOIA regulation at 45 CFR § 5.65(d) and by Executive Order 12,600 to give the submitter notice before the information is disclosed. To determine whether the submitter's information is protected by Exemption 4, the submitter must show that (1) disclosure of the information is likely to impair the government's ability to obtain necessary information in the future; (2) disclosure of the information is likely to cause substantial harm to the competitive position of the submitter; or (3) the records are considered valuable commodities in the marketplace which, once released through the FOIA, would result in a substantial loss of their market value. Consistent with our approach under the Part C program, we would not release information under the Part D program that would be considered proprietary in nature or that would tend to stifle the availability of discounts or rebates from pharmaceutical manufacturers negotiated by Part D plans.

Bidders may identify trade secrets and confidential business information (CBI) with their submission. However, if they have not we will give them another chance when a FOIA request has been made on their records. In this case we will notify the business submitters that we are in receipt of FOIA requests for their records. We will then provide the business submitters with instructions and ask them to identify any trade secret or CBI in order to justify our application of Exemption 4. We will then review their justifications and highlighted information against FOIA case law to see if we can support their requested redactions. Under Executive Order 12600, if the business submitters disagree with our Exemption 4 analysis (which includes their justification) of their identified trade secret or CBI, they are provided the opportunity to seek a restraining order or injunction in Federal court prohibiting us from releasing their records under FOIA. (70 FR 4294 through 4295)

Thus, for example, we do not expect that any pricing data included on the claim that fits within FOIA Exemption 4 would be required to be released under FOIA.

We also note that we do not view data releases made under the authority of the new § 423.505(m) as FOIA releases. Unlike FOIA releases, these releases are not required by law. Section 423.505(m) permits the release of data, but does not require it.

Comment: A number of commenters underscored the importance of CMS making patient identifiers available in order to achieve the full potential of Part D data. One commenter stated prescription drug claims files by themselves lack the diagnostic, outcomes and other information to support the needed studies. However, when merged with other data, they can become a powerful tool for improving the public health. Reflecting the views of several other commenters, the commenter noted that Part D claims data could be linked to several other data sets such as: death and birth certificate files; nursing homes Minimum Data Set; home health care Outcome and Assessment Information Set files; disease registries such as the Surveillance, Epidemiology, and End Results-Medicare dataset developed by the National Cancer Institute to study outcomes of cancer therapies; geographical data on characteristics and health care resources of communities; information on characteristics of providers (for example, use of primary medical care versus specialty care); and Medicaid data on health care encounters and services not covered by Medicare. The commenter emphasized that linking Part D data to the above information is essential in order to provide accurate accounting for outcomes and to best address the many scientific pitfalls and potential threats to validity that emerge when one moves from experimental to observational studies, such as unobserved variable bias and confounding by indication or counter-indication.

Another commenter stated that linkage of the Part D data to population-based surveys would provide invaluable sources for epidemiologic, health services and policy analyses and enable investigations into prevalence of diseases, their risk factors, progression, and trends in treatment and drug use.

Response: We agree these data are more powerful when linked with other data sets. Linkage to Medicare Parts A and B data is essential for understanding the impact of the Part D benefit on use of other Medicare services. There are a host of other types of research studies that could not be completed without linked data. These include: studies examining the impact of changes in benefit structure on patient outcomes, research into the relative effectiveness of pharmacologic therapies or medication therapy management interventions, and pharmacovigilence studies. In many cases, Part A/B linked data provided through our chronic condition warehouse with encrypted identifiers will be sufficient to accomplish the research. In cases where beneficiary identifiers are essential for linkage with non-Medicare data bases, such as the National Center for Health Statistics Surveys, beneficiary-identifiable data may be released, but will be subject to the Privacy Act and HIPAA data security and privacy requirements consistent with those we require in our data release policies for identifiable Part A/B data. These requirements include a CMS Privacy Board review/approval, submission of a Data Use Agreement, and the justification of minimum data necessary to carry out the project. If the data is going to be linked to data collected under another federally funded study, the requestor must also secure the Federal project officer's concurrence and an Institutional Review Board (IRB) approval.

Comment: A few commenters were concerned that CMS had not adequately addressed the implications of expanding access to physician and patient information. They recommended that we specify more clearly the conditions under which physician data can be collected and used in performance programs, research studies, and demonstration projects, noting that revealing physician identification information will enable pharmaceutical companies and others to influence physicians' prescribing patterns and interfere with a physician's professional judgment.

Response: We believe that an encrypted version of the physician identifier, which will allow for the linkage of all of a physician's claims without divulging the physician's identity, will meet the needs of most researchers. Accordingly, we will evaluate research requests for physician identifiers (for example, that could be used to link Medicare data at the physician level to other datasets) on a case-by-case basis and will only consider providing them if necessary for the study under our minimum data necessary policy and permitted under applicable law. In addition, we will continue our current practice of not providing identifiable data for commercial purposes. This limitation should address the concern regarding pharmaceutical company interference with medical practice.

In addition to releasing physician identifiers in response to certain research requests, we anticipate releasing physician identifiers to States, and pilot and demonstration projects, as the ability to link all of a physician's claims may be necessary for care coordination and disease management purposes. Physician identifiers may also be used by or released to other government agencies or contractors, as part of populating personal health records, so that beneficiaries will have a record of who prescribed their drugs. Finally, we anticipate that they may be used in connection with or released to support the Secretary's Value-driven Health Care initiative which seeks to improve the quality and efficiency of health care delivery by making performance measurement information available to better support provider and consumer health care decision-making.

One of the goals of the Secretary's Value-driven Health Care Initiative is to promote public reporting of performance measurement results at the provider and physician level that may be based on public sector claims, private sector claims, and other data in order to enable providers, including physicians, and consumers to make informed health care decisions. We envision using the claims data to develop provider and physician-level performance measurement results.

Comment: A commenter supported CMS's use of Part D data to manage cost and clinical quality and argued that providing external parties access to linked physician identifiable claims in order to pool them with employer data would allow analysis to reduce the cost of care delivery and improve the quality of care. The commenter stated that increasing transparency of care in the outpatient sector is critical and that protecting physicians from oversight cannot continue.

Response: We are undertaking a variety of pay for performance and value-based health care initiatives in an effort to encourage health care providers to furnish high quality health care and in order to provide cost and quality information to consumers. We intend to use the Part D claims data in these activities. Similarly, other Federal executive branch agencies (and their contractors) will have access to physician identifiers, if appropriate. We are working with external stakeholders, including multi-stakeholder coalitions that represent providers, consumers, employers, and health plans, regarding how to pool Medicare data with private data for analysis and how to make the results available to the public. As these plans mature, more information will be shared with the public.

Comment: While many commenters supported the use of Part D claims data for detecting and analyzing unintended risks and benefits of medications, they also noted the limitations of claims-based research for answering questions about the comparative efficacy and safety of drugs. The commenters asserted that claims-based outcomes research, such as with Part D claims data, can reveal correlations between variables or events, but is often not sufficient to establish causation. They offered specific suggestions such as holding researchers to high methodological and ethical standards, creating study panels of qualified external stakeholder experts to review research protocols, and encouraging CMS to conduct an open and transparent process that will allow for external verification and replication of CMS's sponsored analyses.

Response: We are well aware of the limitations involving retrospective, claims-based research. Our current data release policies for Parts A and B data for externally-funded research require that a requestor submit a detailed proposed research protocol. We review these proposals for the legitimacy and feasibility of the research, the strength of the proposed methods for guarding the privacy of the data, and the appropriateness of the research methods. Research requests for Part D claims data would be subject to the same type of review.

Comment: Some commenters suggest that CMS make available the number of external requests it receives for claims data, the manner in which the agency responds to those requests, the timeliness of the approval process, and any fees charged for various types of data. They also believe that CMS should describe the Federal priorities for government-sponsored research using Medicare Part D claims data, and provide for public notice and comment on proposals based on processes already established by Agency for Health Research and Quality (AHRQ).

Response: We already maintain data on the number of external research requests for our claims data, whether the request was approved, the timeliness of the approval process, and any fees charged for various types of data. We can make this information available to the public, upon request, and will explore posting it on our Web site.

We do not believe we should establish Federal priorities for research using Part D claims data, just as we do not establish priorities for research using Medicare Parts A and B data. Much of our research agenda is determined by directives from the Congress for research studies, demonstrations and their evaluation. Accordingly, a public comment process on CMS-sponsored research is not necessarily feasible. However, other Federal government executive branch agencies that are likely to sponsor comparative effectiveness or safety research using Part D claims data, such as AHRQ, do have such priority-setting processes in place. We believe these processes are adequate to address the commenters' concerns.

Comment: A few commenters suggested that we make available Part D claims data to State Medicaid directors for the purpose of monitoring and researching the dual eligible population. The commenters suggested we provide States with access to the drug utilization and spending data collected by the Medicare Part D prescription drug plans, as well as other data necessary for states to effectively coordinate the care of dual eligibles.

Response: We believe that States may improve their disease management and other care coordination programs by examining utilization data of dual eligibles extracted from Part D claims. In this final rule, we have clarified that we will be permitted to use collected Part D claims data for care coordination and disease management purposes. Under § 423.505(m), we may release collected Part D claims data to States, consistent with our minimum data necessary policy, our data sharing procedures, applicable laws, and subject to encryption of certain identifiers and aggregation of cost data. We plan to explore the operational issues associated with such an exchange. As a result, we believe States will have appropriate access to Part D claims data for purposes of coordinating the care of dual eligible beneficiaries. Please see § 423.505(m), as well as the appendix to this final rule for additional explanation of how we would determine the data that would be released to States.

Comment: Commenters requested further discussion on the types of entities to which collected Part D claims data will be released. A commenter also contends that the recipients of data could share the data with third parties of their choice.

Response: Identifiable data are not released to all external requesters. Currently, for Parts A and B data, external researchers must request the identifiable data from us. Our privacy board reviews the request for beneficiary identifiable data to determine if the request is for an appropriate research purpose, whether the Privacy Rule's criteria are met, and that the request is consistent with our data release policies. Our data release policies do not allow us to release identifiable data for marketing or commercial purposes. Further, we do not approve requests from for-profit organizations or organizations that could profit from a study, although we do produce databases with identifiers stripped, as well as public use files, for any organization to use. We also have requirements for release of Parts A and B data to other Federal governmental entities and contractors for purposes not related to research. Generally, we use DUAs to track the disclosure of personally identifiable data to such entities. Under our data sharing policies, we generally require the requester not to disclose the data to third parties without specific written authorization from us. The release of data must also be permissible under the Privacy Act, the HIPAA Privacy Rule, the Trade Secrets Act, and any other applicable laws.

Comment: A commenter recommended that CMS include a requirement that the recipient obtain a certification of confidentiality for all identifiable CMS data covered by the agreement or other data within the scope of the research project to protect researchers when compelled to release protected data.

Response: Under section 301(d) of the Public Health Service Act (42 U.S.C. 241(d)) the Secretary of Health and Human Services may authorize persons engaged in biomedical, behavioral, clinical, or other research to protect the privacy of individuals who are the subjects of that research. This authority has been delegated to the National Institutes of Health (NIH). Certificates of confidentiality are issued to protect identifiable research information from forced disclosure. Certificates of confidentiality may be appropriate for research that combines the direct study of human subjects with the use of identifiable Part D data. They allow the investigator and others who have access to research records to refuse to disclose identifying information on research participants in any civil, criminal, administrative, legislative, or other proceeding, whether at the Federal, State, or local level. Certificates of confidentiality may be granted for studies collecting information that, if disclosed, could have adverse consequences for subjects or damage their financial standing, employability, insurability, or reputation. By protecting researchers and institutions from being compelled to disclose information that would identify research subjects, certificates of confidentiality help achieve the research objectives and promote participation in studies by assuring confidentiality and privacy to participants. The Department would encourage researchers to explore with their institutional review boards or other knowledgeable experts the use of certificates of confidentiality where appropriate. If a researcher has obtained a certificate of confidentiality for a human subjects study, its protection would extend to all individually identifiable data on the research subjects in that study (including Part D data.) maintained in the research records. Additional information about certificates of confidentiality is available on our Web site at http://grants2.nih.gov/​grants/​policy/​coc/​.

Comment: Several commenters stated their concern that the proposal would run afoul of Federal confidentiality protections for substance abuse laws such as 42 CFR Part 2.

Response: As the commenter notes, regulations at 42 CFR Part 2 “Confidentiality of Alcohol and Drug Abuse Patient Records,” establish restrictions on the disclosure and use of alcohol and drug abuse patient records that are maintained in connection with the performance of any Federally-assisted alcohol and drug abuse program. These regulations limit disclosures of any patient-identifying information acquired by a Federally-assisted facility that provides alcohol or drug abuse diagnosis, treatment, or referral for treatment. We will work with Part D sponsors to ensure that these specifically protected claims are not redisclosed for purposes other than payment. One option that we plan to explore to comply with these regulations is to identify a set of drugs which are used for the treatment of alcohol and substance abuse (that is, Anatabuse and Vivtrol) and exclude associated PDEs for these drugs from any sample of PDEs used for purposes other than carrying out section 1860D-15 of the Act (that is, for nonpayment purposes).

Comment: We received a number of comments on how the rule will be implemented. Commenters requested that CMS ensure that: Part D claims data file formats are consistent with other CMS data files; limited data sets (LDS) be available linking Medicare Parts A, B and D data; and files be in a clean format that is sufficiently detailed and secure. Other commenters requested that Part D claims data be made available in a linkable format that includes details of prescriptions by patient, time, and location, in order to address the shortcomings in the current management of chronic diseases.

Response: We do not believe that the detailed formatting standards requested by the commenters are an appropriate subject of this final rule. However, we recognize the need to ensure appropriate security of data, and will apply the processes and procedures regarding the transmission and storage of data currently in place to protect Parts A and B data to Part D claims data. We also note that linked data files will contain both a patient's chronic conditions and detailed information regarding prescriptions.

Comment: Several commenters recommended that CMS consider developing and releasing a summary file that parallels the current Physician Supplier Procedure Summary Master file along with a 5 percent sample standard analytical file. One commenter asked that both LDS files and Research Identifiable files be available and asked for clarification of the file types available from the CCW.

Response: As stated, we do not believe that detailed formatting standards are the subject of this final rule. We also note that both LDS files and research identifiable files are available from the CCW. We anticipate filling most research requests for Part D claims data using LDS files available from the CCW or from other places.

Comment: One commenter questioned how plan sponsors are to comply with applicable State privacy laws that may preclude disclosure of medical information for one or more of the purposes listed in the proposed regulatory text. The commenter requested that CMS explain whether any such conflicting state law prohibitions would be preempted by the proposed regulation, notwithstanding that § 423.136 of the regulations states that state confidentiality and disclosure laws are not preempted.

Response: Part D sponsors should comply with all applicable Federal and state confidentiality and disclosure laws when not directly conflicting. Part D regulations specifically require prescription drug plans to comply with these laws. If there is a belief that a particular State law is in direct conflict with our Federal requirements, plan sponsors should bring those specific cases to our attention for individual review.

Comment: One commenter contended that CMS can share Part D claims data freely with its contractors, who may also be researchers, under section 1860D-15 of the Act.

Response: Section 1860D-15 of the Act only relates to disclosures necessary to carry out that section, which would permit sharing of Part D data with contractors only for payment purposes. This regulation, which is established under the authority of section 1860D-12 of the Act, would permit us to collect the original 37 PDE elements comprising the Part D claims data for nonpayment-related purposes, and allow the agency and its contractors to use them for nonpayment-related purposes (section 1874 of the Act permits the Secretary to perform his functions by contract).

Comment: A commenter contends that it is impossible to assess the intent of CMS without the ability to review the system of record notice for data collected under Part D. The commenter wants CMS to republish the proposed rule along with the applicable system of records notice.

Response: We believe the proposed rule contained enough information for interested parties to assess our intent. We plan to publish a revised system of records notice shortly to ensure that the regulation and its system of records are effective as close to the same time as possible.

Comment: One commenter stated CMS should complete a Privacy Impact Assessment (“PIA”).

Response: We annually update all appropriate PIAs. Accordingly, we will be updating the Drug Data Processing System PIA every year.

Comment: A commenter recommended that the subjects of any data disclosed to a third party be parties to CMS's data use agreement, so that they may seek relief for a breach of the agreement.

Response: The format and procedures for our data sharing agreements are not strictly within the scope of this final rule. Moreover, we do not believe the commenter's recommendation would be advisable because it may significantly hamper the ability of researchers to perform the activities that benefit the public's health under this rule. Researchers may ultimately expend an enormous amount of resources responding to third party claims. However, we do note that signatories of our data use agreements can be sanctioned if they violate the agreement or Federal law.

Comment: We received several comments suggesting that we establish a process for reviewing research requests based on a `first in, first reviewed' process.

Response: The internal procedures we use in reviewing requests for data are not strictly within the scope of this final rule, as the proposed rule did not make recommendations related to our data-sharing process. However, we do plan to continue the practice of giving government agencies first preference in the review process, and to require that such agencies abide by our data sharing procedures, which generally require a data sharing agreement.

External research requests are usually reviewed in the month they are received with the exception of time sensitive research requests, which may be considered in an expedited manner, at our discretion. Because we expect a large volume of requests, there may be a delay between when a request is received, reviewed, and approved or denied. As we do currently with Parts A and B data requests, we will continue to carefully consider each research request with a review process that emphasizes compliance with applicable laws, including those governing the protection of privacy, first, followed by legitimacy of the requested study, and the requestor's expertise.

D. Beneficiary Access to Part D Claims Data

The proposed rule stated that we were considering the use of Part D claims data for projects involving the development or population of personalized health records, which include beneficiary medication history, which would be accessible by Medicare beneficiaries or their providers after the beneficiary consents to such a release. We requested comments on this proposed use of Part D claims data collected under the authority of section 1860D-12(b)(3)(D) of the Act.

In this final rule, after considering the comments received, we are expanding the use of the collected Part D claims data so that we may authorize the use and release of these data to government contractors or external entities for the population of personal health records.

Comment: Generally, commenters encouraged CMS to pursue projects of this nature, with one commenter in particular noting that the personalized medication history record could be linked to the MyMedicare.gov Web site and could include links to a beneficiary's Part D plan, its formulary, and the plan's instructions for prior authorization requests.

A few commenters requested more detail regarding the development of PHRs, the protection of beneficiary health information, and the Web-based standards (that is, record security, record retrieval, browser compatibility, etc.) underlying the display of PHRs. They suggested that we use a transparent, public process for developing these ideas and allowing for public comments. One commenter referenced the URAC (the organization formerly known as the Utilization Review Accreditation Commission) standards for Web-based clinical content and another, the Medicare pilot demonstration project conducted by the United Mine Workers Health and Retirement Fund as a model of a project.

Response: Currently, we are conducting pilot projects and studies on personal health records that include the disclosure of hospital and provider claims data (Part A and Part B) to populate beneficiaries' PHRs. However, until this rule is effective, we cannot include Part D claims data in these projects. When we have authority to disclose Part D claims data, we will provide the Part D claims data to populate PHRs only upon the authorization of the beneficiary. We require our partners in PHR pilots and studies to agree to strict privacy and security safeguards whenever receiving, using or disclosing beneficiary data. The pilots and studies are intended, in part, to help inform us in developing privacy rules and security arrangements that would be appropriate for a program of ongoing disclosures to populate and update the PHRs, as authorized by beneficiaries.

In the area of health information technology, the Department has a history of developing policy in a collaborative, open, and transparent manner. In addition to obtaining public comment through notice in the Federal Register, such as this, the Department relies on its public advisory committees, relationships with industry, and participation in professional associations in developing policies and procedures with respect to the emerging health information environment. With regard to PHRs, the information we gather through this process will also help us determine future steps.

Comment: Several commenters stated that beneficiary participation in such projects should not be mandatory, but voluntary.

Response: We expect that any program we plan to undertake to make collected Part D claims data available to beneficiaries would be voluntary on the part of beneficiaries.

Comment: A commenter noted that beneficiaries already have the right to request access to, inspect, and copy their medication histories and other PHI.

Response: We appreciate the commenter's statements that beneficiaries already have access to their medical records, but believe that a centralized PHR that is easily accessible from a Web site, and that includes a more comprehensive set of data from multiple providers and prescribers, would be of use to beneficiaries.

Comment: A commenter urged CMS to establish procedures where the data will be automatically available to other health care practitioners and institutions. The commenter stated that a beneficiary may be unable to release the record due to being unconscious or confused. Finally, the commenter noted reasons why, under Parts A and B, the personalized EHR is necessary, including the value of having a complete record in an emergency room situation and in instances when a physician administers medications incident to a physician visit.

Response: Any PHI that CMS releases to providers or institutions would be authorized by the beneficiary or the beneficiary's authorized representative or would be otherwise permitted or required under the applicable laws and our policies. Moreover, we note that health care providers are not necessarily the intended users of PHR; rather, they are intended for use by the patient. We believe it more likely that emergency room and other health care providers would have access to patient's medication history from another source.

Comment: One commenter noted that Part D claims data may be of limited value in creating a PHR.

Response: We believe that access to medication history information, even of limited scope, is deemed one of the top priorities by emergency responders, emergency room personnel and physicians, in discussions regarding electronic PHRs.

Comment: A commenter noted that PHR information shared with entities other than the beneficiary should only be released in an aggregated format without any physician identifiers.

Response: We requested comments on the usefulness of creating a personalized beneficiary medication history record from the Part D claims data. We are uncertain as to why the commenter believes it would only be appropriate for physician information to be released at the aggregate level since the purpose of PHRs is to allow individuals and their providers to have access to information to improve the quality and delivery of care to the individual. Any sharing of this data with organizations that assist beneficiaries in developing their own PHR would need to be authorized by the individual to whom the record pertains, just as the individual would provide authorization for release of any other of his or her personal data held by Medicare.

E. Applicability

We stated in the proposed rule that the proposed revision does not affect the applicability of HIPAA to the DHHS or any other appropriate parties, nor does it affect the applicability of the Privacy Act (5 U.S.C. 552a) or the Trade Secrets Act (18 U.S.C. 1905). Thus, Part D claims data, like any personally identifiable information or PHI collected by the agency, are subject to protection under the HIPAA Privacy Rule, the Privacy Act and the Trade Secrets Act, and other laws, as applicable. In this final rule, we continue to take this position.

Comment: One commenter stated that the proposed rule does not explain why HIPAA does not apply to Part D activities when HIPAA does apply to CMS activities for Parts A and B of Medicare.

Response: The HIPAA Privacy Rule applies to covered entities and defines the term “covered entity” as (1) a health plan, (2) a health care clearinghouse, or (3) a health care provider who transmits any health information in electronic form in connection with a covered transaction. (See 45 CFR 160.103.) HIPAA defines “health plan” as an individual or group plan that provides, or pays the cost of medical care, and specifically includes Part A and Part B of the Medicare program under title XVIII. (See section 1171(5) of the Act and 45 CFR 160.103 (definition of health plan).) With respect to Part D, because Part D sponsors meet the definition of health plan, they are covered entities subject to HIPAA. HIPAA does not apply to the component of CMS that administers the Part D program because it is does not pay claims directly. However, although Part D claims information held by this component is not directly subject to HIPAA, the Part D data are protected under the Privacy Act of 1974, which applies to all federal agencies' data collections of individually identifiable information in systems of records. The Privacy Act requires that CMS maintain Part D data in a protected system of records and may only use or disclose the data in accordance with the specific purposes which have been published in the Federal Register and with other uses and disclosures allowed by the Privacy Act, itself. See 5 U.S.C. 552a(b) and (e)(4).

This rule will allow the Secretary to use the original 37 PDE elements that are being collected for Part D payment purposes for reporting to the Congress and the public, conducting evaluations of the overall Medicare program, making legislative proposals to Congress, and conducting demonstration projects. To the extent that such information becomes part of our administration of the Medicare Part A and Part B programs, HIPAA will apply to such information. Moreover, although Part D claims information held by the component of CMS that administers the Part D program are not directly subject to HIPAA, we are choosing to comply with HIPAA's limitations on the use and disclosure of PHI to ensure that beneficiaries' privacy interests are fully protected. In addition, we are choosing to impose standards similar to those applied when we release beneficiary identifiable information with respect to non-beneficiary identifiable Part D data, on the PDE, such as plan, prescriber, and pharmacy identifiable data.

Comment: One commenter noted that many plan sponsors already share data with agencies such as the FDA, NIH, and AHRQ, and external entities subject to HIPAA, therefore there is no need for this rulemaking.

Response: While plan sponsors may already share data with agencies such as FDA, NIH, and AHRQ, only CMS can share Part D claims data linked to Medicare Parts A and B data. Therefore, we maintain that this rulemaking is necessary.

Comment: Some commenters expressed concern with CMS' use of data use agreements. They asked that CMS explain the steps we will undertake to ensure the confidentiality of individually identifiable beneficiary data.

Response: In response to the commenter's concerns about CMS' reliance on data use agreements (DUAs), we administer DUAs for any data disclosures to external entities, including limited data sets that exclude certain personal identifiers. The DUA is a way to ensure that the data provided are only used for the purposes for which the data were disclosed. All external requests for personally identifiable data for research are subject to CMS' Privacy Board review and approval.

Currently, for Parts A and B data, CMS restricts data releases to the minimum amount of information necessary for the requestor's specific research project. We intend to operate on the same basis, with some additional restrictions to protect privacy and commercially sensitive information as described our regulations at § 423.505(m) as well as in the appendix to this final rule, with respect to the release of collected Part D claims data. We anticipate that we will be able to satisfy many requests for Part D claims data using limited data sets, which exclude certain personal identifiers.

Comment: A commenter was concerned with the release of prescriber identifiers, believing that the release of such data could be used to target marketing efforts and otherwise improperly affect a prescriber's judgment.

Response: As explained previously in section II.B. of this final rule, we expect that the results of the Secretary's quality improvement and performance measurement initiatives may be made public in an effort to financially reward health care providers who provide high quality health care and to provide cost and quality information to consumers. Beyond that, we will encrypt prescriber identifiers as a general matter with limited exceptions (see 42 CFR 423.505(m), as well as the appendix to this final rule). Additionally, we will not release Part D claims information for commercial purposes.

Comment: A commenter contended that for a HIPAA-covered entity the proposed rule will impose a substantial compliance burden and monetary costs to transform each prescription drug claim that a plan sponsor submits for payment purposes into an accountable disclosure that the plan sponsor would need to track in order to fulfill its accounting of disclosures obligations under the HIPAA Privacy Rule. The commenter also stated that the proposal may burden plan sponsors by possibly requiring many to distribute revised notices of privacy practices, which may cause beneficiary confusion. The commenter states that CMS should be precluded from implementing the proposed rule except at the beginning of a calendar year.

Response: Regularly, laws and regulations intersect or overlap, and individuals and entities are required to dissect the application of such laws and regulations, as appropriate. This rule does not regulate how covered entities, subject to HIPAA compliance, must comply with the HIPAA Privacy Rule, nor was it intended to do so. As a general matter, Part D plan sponsors are subject to a wide range of Federal laws and regulations, including HIPAA, and in this instance there may be an intersection between such laws and regulations that requires analysis and consideration. As we noted in the preamble to the proposed rule, nothing in this final rule affects the applicability of HIPAA (or the Privacy Act) to the DHHS or any other appropriate parties.

Since the proposed rule did state that it did not affect the applicability of HIPAA, we believe a brief discussion of the intersection between this rule and existing HIPAA rules is warranted. However, it is important to note that the Office for Civil Rights (OCR) is the only agency within DHHS that can provide advice on and enforce the HIPAA Privacy Rule. Affected entities can obtain comprehensive information regarding the HIPAA Privacy Rule, including answers to frequently asked questions and information on the enforcement program, at http://www.hhs.gov/​ocr/​hipaa/​.

With this in mind, we believe that private plans are permitted by the HIPAA Privacy Rule to make the disclosures provided for in this Rule. The HIPAA Privacy rule permits disclosures for health oversight and as required by law. See 45 CFR 164.512(a) and 164.512(d). We are not suggesting that the HIPAA definition of “required by law” at 45 CFR 164.103 encompasses contractual requirements. Rather, we believe those disclosures required by contract, which are also mandated by statute or regulation or both, would be “required by law” under the HIPAA Privacy Rule.

As noted previously above, plans disclosing data under this rule may face HIPAA compliance issues regarding accounting and Notice of Privacy Practices. We believe that most Part D plans very likely have a statement in their existing Notices of Privacy Practices that notifies enrollees of permitted disclosures for purposes of health oversight and as required by law, and therefore, are unlikely to have to modify their notices of privacy practices.

An individual also has the right under the HIPAA Privacy Rule to receive an accounting of certain disclosures, including disclosures for health oversight purposes or disclosures required by law. It is each plan's responsibility to comply with the HIPAA Privacy Rule as it deems appropriate.

Finally, we do not believe that any further delay in the effective date for this regulation is required. We believe the commenters are referencing the prohibition on mid-year significant regulatory requirements at 42 CFR 423.516. However, that regulation does not apply to already-existing regulations, such as HIPAA regulations, or the impact already-existing regulations will have on a new Part D regulation. Because we already collect Part D claims data, this regulation does not impose additional Part D requirements on Part D sponsors, and therefore, we do not view this regulation as constituting a significant midyear change for Part D sponsors.

Comment: The commenter also questioned how CMS would notify beneficiaries that their data may be released for research purposes.

Response: As a general matter, how we comply with our own HIPAA obligations is outside the scope of the proposed rule. To the extent HIPAA requires us to take any additional steps (including additional notification responsibilities) to ensure full compliance with HIPAA, we intend to do so. For instance, a covered entity is required to include in its notice of privacy practices a statement that PHI may be used for research purposes. CMS, as a covered entity for Medicare Parts A and B, currently provides such notice to beneficiaries annually.

Comment: Several commenters requested that CMS discuss the regulation in light of the Trade Secrets Act, specifically with respect to pricing data.

Response: Because our regulations at 42 CFR 423.505(f), (l), and (m) are issued under the authority of section 1106 of the Act, any release of potentially proprietary data under these regulations would also be authorized by law under the Trade Secrets Act. As we have stated elsewhere in this preamble, we believe that our minimum data necessary policy with some additional restrictions to protect privacy and plan commercially sensitive information and our data sharing procedures will guard against any potential misuse or inappropriate disclosure of Part D claims data.

F. Limitations

This final rule in no way affects or limits our existing ability to collect non-payment data such as enrollment, formulary, price comparison, quality assurance and utilization review data. In such cases, even where the data collection is not specifically mandated by statute, we do not believe it is necessary to resolve any statutory ambiguity, because section 1860D-15 of the Act would not apply.

In addition, it is important to note that this rule applies when collections of data occur under section 1860D-12 of the Act. The rule does not address collections that occur under other provisions of law. Thus, this rule also does not address uses or disclosures already permitted under section 1860D-15 of the Act, to carry out audits and evaluations necessary to ensure accurate and correct payment and to otherwise oversee Medicare reimbursement under Part D. These uses are already contemplated under both the statute and the regulations at § 423.322(b). Furthermore, section 1860D-15 of the Act and § 423.322(b) of our regulations do not limit the ability of OIG to access, use, or disclose Part D claims data as part of the Inspector General's statutory responsibilities to oversee the Medicare program.

III. Provisions of the Final Regulations

This final rule finalizes most of the provisions of the proposed rule. Those provisions of this final rule that differ from the proposed rule are as follows:

• In part 423, adding section 1106 of the Act to the authority citation.
• In § 423.1, adding section 1106 of the Act.
• In § 423.505, making the following changes:

++ Revising paragraph (f)(3) to clarify that the regulatory provision is only applicable to Part D claims data and is limited to the original 37 elements reported on the PDE record; to add a reference to pilot projects, and to add care coordination and disease management activities, quality improvement and performance measurement activities, and the populating of personal health records to the list of necessary and appropriate purposes for the collection of this information. This list is not intended to be exclusive, and Part D claims data may be collected for other purposes that the Secretary deems necessary and appropriate.

++ Removing paragraph (f)(5) and incorporating the provisions of this paragraph in paragraphs (l) and (m).

++ Adding a new paragraph (l) to specify that CMS may use the data collected under § 423.505(f)(3).

++ Adding a new paragraph (m) to specify that CMS may release the minimum data collected under § 423.505(f)(3) in accordance with applicable Federal laws, our established data sharing procedures, and subject to encryption of certain identifiers and aggregation of cost data to protect beneficiary confidentiality and commercially sensitive data of Part D sponsors.

IV. Collection of Information Requirements

Under the Paperwork Reduction Act of 1995, we are required to provide 30-day notice in the Federal Register and solicit public comment before a collection of information requirement is submitted to the Office of Management and Budget (OMB) for review and approval. In order to fairly evaluate whether an information collection should be approved by OMB, section 3506(c)(2)(A) of the Paperwork Reduction Act of 1995 requires that we solicit comment on the following issues:

• The need for the information collection and its usefulness in carrying out the proper functions of our agency.
• The accuracy of our estimate of the information collection burden.
• The quality, utility, and clarity of the information to be collected.
• Recommendations to minimize the information collection burden on the affected public, including automated collection techniques.

This document does not impose new information collection requirements on Medicare Part D plans. Medicare Part D plan sponsors already submit the information required to conduct the studies discussed earlier in the preamble of this document. Medicare Advantage prescription drug plan (MA-PD) sponsors, prescription drug plan (PDP) sponsors, and Fallback plan sponsors, as required by the MMA, are required to submit payment-related data to CMS that include, but are not limited to, Part D claims data. The information collection requirements associated with the collection of prescription drug data from MA-PD, PDP and Fallback plan sponsors for Medicare Part D payments are currently approved under the Office of Management and Budget (OMB) Control No. 0938-0982, with an expiration date of November 30, 2009. Additionally, we have included a discussion of the currently approved information collection requirements associated with the Medicare Part D reporting requirements and the plan benefit package (PBP) and formulary submission for Medicare Advantage prescription drug plans (MA-PD) and prescription drug plans (PDPs). The information collection requirements (ICRs) for the Part D reporting requirements and the plan benefit package are approved under OMB Control Nos. 0938-0992 and 0938-0763, respectively.

A. ICRs Regarding Contract Provisions (§ 423.505)

Section 423.505 discusses provisions that must be contained in contracts between Part D plan sponsors and CMS. Specifically, § 423.505(b)(8) requires that a Part D plan sponsor comply with the disclosure and reporting requirements in § 423.505(f), § 423.514, and § 423.329(b), respectively. Section 423.505(f) lists the information that Part D plan sponsors are required to disclose to CMS. This information includes but is not limited to the disclosure of certified financial information, the disclosure of all information necessary for us to administer and evaluate the program and to simultaneously establish and facilitate a process for current and prospective beneficiaries to exercise choice in obtaining prescription drug coverage, and the disclosure to its enrollees of all informational requirements under § 423.128 and, upon an enrollee's request, the financial disclosure information required under § 423.128(c)(4).

B. ICRs Regarding Reporting Requirements (§ 423.514)

Section 423.514 outlines the reporting requirements for Part D plan sponsors. Section 423.514(a) requires each Part D plan sponsor to have an effective procedure to develop, compile, evaluate, and report to CMS, to its enrollees, and to the general public, at the times and in the manner that CMS requires. Section 423.514(b) requires Part D plan sponsors to report to CMS annually, within 120 days of the end of its fiscal year, significant business transactions. In addition, § 423.514(c) sets forth the requirements for submitting combined financial statements. For any employees' health benefits plan that includes a Part D plan sponsor in its offerings, § 423.514(d) addresses the reporting and disclosure obligations under the Employee Retirement Income Security Act of 1974 (ERISA). Section 423.514(e) states that each Part D plan sponsor must notify CMS of any loans or other special financial arrangements it makes with contractors, subcontractors and related entities. Section 423.514(f) requires each Part D plan sponsor to make the information reported to CMS under this section available to its enrollees upon reasonable request.

C. ICRs Regarding Determination of Payments (§ 423.329)

Section 423.329(b) contains the reporting requirements for PDPs and MA-PDs for the purposes of determining health status risk adjustment. As stated in § 423.329(b)(3)(i), PDPs are required to submit data regarding drug claims that can be linked at the individual level to Part A and Part B data in a form and manner similar to the process provided under § 422.310 of this chapter and other information as we determine necessary. In addition, § 423.329(b)(3)(ii) requires MA organizations that offer MA-PD plans to submit data regarding drug claims that can be linked at the individual level to other data that the organizations are required to submit to CMS in a form and manner similar to the process provided under § 422.310 and other information as we determine necessary.

D. ICRs Regarding Contract Provisions (§ 423.505(b)(8))

The burden associated with the requirements in § 423.505(b)(8) of this regulation is the time and effort associated with meeting the aforementioned requirements in § 423.505(f), § 423.514, and § 423.329(b). As stated earlier, these requirements are subject to the PRA; however, they are approved under existing OMB control numbers. The requirements in § 423.505(f) and § 423.514 are currently approved under OMB control number 0938-0992 with an expiration date of June 30, 2008. The information collection requirements contained in § 423.329(b) are currently approved under OMB control number 0938-0763, with an expiration date of November 30, 2009.

Table 1.—Estimated Annual Reporting and Recordkeeping Burden

Regulation section	OMB Control number	Number of respondents	Number of responses	Burden per response (hours)	Total annual burden (hours)
§ 423.505 ** and § 423.514 **	0938-0992	3,203	179,368	.69	123,764
§ 423.329 **	0938-0763	430	4,515	2.29	**10,319
Total					138,469
** As specified by § 426.505(b)(8)

As required by section 3504(h) of the Paperwork Reduction Act of 1995, we have submitted a copy of this document to the Office of Management and Budget (OMB) for its review of these information collection requirements.

V. Regulatory Impact Statement

We have examined the impact of this rule as required by Executive Order 12866 (September 1993, Regulatory Planning and Review), the Regulatory Flexibility Act (RFA) (September 19, 1980, Pub. L. 96-354), section 1102(b) of the Social Security Act, the Unfunded Mandates Reform Act of 1995 (Pub. L. 104-4), Executive Order 13132 on Federalism and the Congressional Review Act (5 U.S.C. 804 (2)).

Executive Order 12866, as amended, directs agencies to assess all costs and benefits of available regulatory alternatives and, if regulation is necessary, to select regulatory approaches that maximize net benefits (including potential economic, environmental, public health and safety effects, distributive impacts, and equity). A regulatory impact analysis (RIA) must be prepared for major rules with economically significant effects ($100 million or more in any 1 year). This final rule does not have economically significant effects of $100 million or more in any one year and therefore is not a major rule.

We assessed alternatives, including, not releasing data to any entity meeting the applicable criteria. We determined that the approach that maximizes public health benefits is the approach taken in the final regulation, which would use a case-by-case evaluation approach similar to the process in use today for Medicare Parts A and B data, with some additional restrictions to protect privacy and commercially sensitive data of Part D sponsors. Weighing all factors, this approach limits the risk that sensitive Part D claims data will be released to inappropriate entities leading to the inappropriate use of this sensitive data, but maximizes the benefit that this data can provide in supporting research studies and other actions that will benefit the public.

We do not believe that new costs associated with compliance under this regulation, if any, will be significant. As stated in section II. E. of this final rule, we expect risk and compliance burdens to be limited; therefore any costs associated with compliance or inappropriate use of data are expected to be limited, and because the use of these data according to applicable laws and CMS data release policies is expected to improve the public's health, this rule does not reach the economic threshold and thus is not considered a major rule requiring a RIA.

The RFA requires agencies to analyze options for regulatory relief of small businesses. For purposes of the RFA, small entities include small businesses, nonprofit organizations, and small governmental jurisdictions. Most hospitals and most other providers and suppliers are small entities, either by nonprofit status or by having revenues of $6 million to $29 million in any 1 year. Individuals and states are not included in the definition of a small entity. While a number of Part D plan sponsors are small entities due to their nonprofit status, few, if any, of the Part D plan sponsors meet the size standard for a small insurance firm by having revenues of $6 million or less in any 1 year. Therefore, an analysis for the RFA will not be prepared because the Secretary has determined that this final rule will not have a significant economic impact on a substantial number of small entities. Furthermore, we believe, the rule does not create a significant economic impact on Part D plan sponsors.

In addition, section 1102(b) of the Act requires us to prepare a regulatory impact analysis if a rule may have a significant impact on the operations of a substantial number of small rural hospitals. This analysis must conform to the provisions of section 604 of the RFA. An analysis for section 1102(b) of the Act will not be prepared because the Secretary has determined that this final rule will not have a significant impact on the operations of a substantial number of small rural hospitals. In fact, we do not expect that it will have any impact on small rural hospitals because the rule relates to Part D plan sponsors, not small rural hospitals.

Section 202 of the Unfunded Mandates Reform Act of 1995 also requires that agencies assess anticipated costs and benefits before issuing any rule whose mandates require spending in any 1 year of $100 million in 1995 dollars, updated annually for inflation. That threshold level is currently approximately $130 million. This final rule will not contain mandates having a negative effect on state, local, or tribal governments in the aggregate, or by the private sector, of $130 million.

Executive Order 13132 establishes certain requirements that an agency must meet when it promulgates a final rule that imposes substantial direct requirement costs on state and local governments, preempts State law, or otherwise has Federalism implications. Even though states may incur costs associated with exchanging data, this regulation does not require states to request Part D claims data, but makes it an option, provided we can resolve any operational issues. In fact, even if States do request data, they may already have systems in place to receive data from CMS. Furthermore, we are not aware of any conflict between this final regulation and State privacy laws (with which Part D sponsors must comply per our regulations). Therefore, we do not believe this final regulation will implicate a Federalism issue through an impact on State privacy laws. Since this regulation does not impose any costs on state or local governments, the requirements of Executive Order 13132 are not applicable.

We received the following comments regarding the impact analysis of the proposal rule:

Comment: One commenter stated that because of the monetary cost and other compliance burdens associated with the implementation of this regulation due to HIPAA, this rule, if implemented, must be implemented at the beginning of a calendar year per § 423.516.

Response: We address this comment in section II. E. of this final rule.

Comment: A commenter stated that in determining whether the rulemaking met the $100 million threshold the value of the information to beneficiaries should have been considered. The commenter states that the value would surpass $100 million, since brokers rent lists potentially for $5 million per rental, often several times a year.

Response: Under our data release policies, we would not allow the release of Part D claims data for commercial purposes. Thus, we do not believe the $100 million threshold would be met based on the example cited by the commenter. It is unlikely that list brokers will receive any nonpublic data from CMS.

In accordance with the provisions of Executive Order 12866, this regulation was reviewed by the Office of Management and Budget.

List of Subjects in 42 CFR Part 423

• Administrative practice and procedure
• Medicare
• Prescription Drugs
• Reporting and recordkeeping

For the reasons set forth in the preamble, the Centers for Medicare & Medicaid Services amends 42 CFR chapter IV as set forth below:

PART 423—VOLUNTARY MEDICARE PRESCRIPTION DRUG BENEFIT

1. The authority citation for part 423 is amended to read as follows:

Authority: Sections 1102, 1106, 1860D-1 through 1860D-42, and 1871 of the Social Security Act (42 U.S.C. 1302, 1306, 1395w-101 through 1395w-152, and 1395hh).

Subpart A—General Provisions

2. Section 423.1 is amended by adding a new reference to paragraph (a)(1) in numerical order to read as follows:

§ 423.1

Basis and scope

(a) * * *.

(1) * * *.

1106. Disclosure of Information in Possession of Agency.

* * * * *

Subpart K—Application Procedures and Contracts With Part D Plan Sponsors

3. Section 423.505 is amended by—

A. Revising paragraph (b)(8).

B. Redesignating paragraph (f)(3) as (f)(4).

C. Adding new paragraph (f)(3).

D. Adding new paragraphs (l) and (m).

The revisions and additions read as follows:

§ 423.505

Contract provisions.

* * * * *

(b) * * *

(8) Comply with the disclosure and reporting requirements in § 423.505(f), § 423.514, and the requirements in § 423.329(b) of this part for submitting current and prior drug claims and related information to CMS for its use in risk adjustment calculations and for the purposes of implementing § 423.505(f), (l), and (m) and § 423.329(b) of this part.

* * * * *

(f) * * *

(3) The 37 original data elements included in all of its drug claims for purposes deemed necessary and appropriate by the Secretary, including, but not limited to, the following:

(i) Reporting to Congress and the public on overall statistics associated with the operation of the Medicare prescription drug program.

(ii) Conducting evaluations of the overall Medicare program, including the interaction between prescription drug coverage under Part D of Title XVIII of the Social Security Act and the services and utilization under Parts A, B, and C of title XVIII of the Act and under titles XIX and XXI of the Act, as well as other studies addressing public health questions.

(iii) Making legislative proposals to the Congress regarding Federal health care programs and related programs.

(iv) Conducting demonstration and pilot projects and making recommendations for improving the economy, efficiency, or effectiveness of the Medicare program.

(v) Supporting care coordination and disease management programs,

(vi) Supporting quality improvement and performance measurement activities, and;

(vii) Populating personal health care records.

* * * * *

(l) CMS may use the information collected under paragraph (f)(3) of this section. Any restriction set forth by § 423.322(b) of this part must not be construed to limit the Secretary's authority to use the information collected under paragraph (f)(3).

(m)(1) CMS may release the minimum data necessary for a given purpose from the data collected under paragraph (f)(3) of this section to Federal executive branch agencies, congressional oversight agencies, States, and external entities in accordance with the following:

(i) Applicable Federal laws.

(ii) CMS data sharing procedures.

(iii) Subject, in certain cases, to encryption of certain identifiers and aggregation of cost data to protect beneficiary confidentiality and commercially sensitive data of Part D sponsors, in accordance with all of the following principles:

(A) Subject to the restrictions in this paragraph, all elements on the claim are available to congressional oversight agencies (as defined in paragraph (m)(1)(iv) of this section) and HHS.

(B) Cost data elements on the claim generally are aggregated for releases to other executive branch agencies, States, and external entities.

(C) Plan identifier elements on the claim are encrypted or unavailable for releases to external entities.

(D) Beneficiary, pharmacy, and prescriber identifier elements on the claim generally are encrypted for releases to external entities, except in limited circumstances, such as to link to another data set.

(iv) For purposes of paragraph (m)(1)(iii) of this section, congressional oversight agencies (the Congressional Budget Office, the Government Accountability Office, the Medicare Payment Advisory Commission, and the Congressional Research Service when acting on behalf of a congressional committee in accordance with 2 U.S.C. 166(d)(1)), States, and executive-branch Federal agencies are not considered to be external entities.

(2) Any restriction set forth by § 423.322(b) of this part must not be construed to limit the Secretary's authority to release the information collected under paragraph (f)(3) of this section.

(Catalog of Federal Domestic Assistance Program No. 93.773, Medicare—Hospital Insurance; and Program No. 93.774, Medicare—Supplementary Medical Insurance Program)

Dated: February 25, 2008.

Kerry Weems,

Acting Administrator, Centers for Medicare & Medicaid Services.

Approved: March 17, 2008.

Michael O. Leavitt,

Secretary.

The following appendix will not appear in the Code of Federal Regulations.

Appendix—Data Element Availability Under Section 1860D-12 of the Social Security Act by Type of Requestor

CMS and its contractors have access to all PDE elements. This chart shows the data elements that are available for release to other federal and state agencies and external entities in the final rule under our minimum necessary data policy subject, in certain cases, to encryption of certain identifiers and aggregation of cost data to protect beneficiary confidentiality and commercially sensitive data of Part D sponsors. Thus, a requestor would not automatically receive all of the available elements, but would only receive those necessary for their study. (Note: As stated in the preamble to the final rule, this chart applies only when data is collected under section 1860D-12 of the Act, and does not apply to any uses or disclosures already permitted under section 1860D-15 of the Act, including to carry out audits and evaluations necessary to ensure accurate and correct payment and to otherwise oversee Medicare reimbursement under Part D. These uses are already contemplated under both the statute and the regulations at § 423.322(b) and are not the subjects of this final rule.)

Data elements	Other (i.e., non-CMS) DHHS entities, and Congressional Oversight Agencies* See Note 1	Non-HHS Executive Branch Agencies and States	External entities
Identifiers
Encryption permits analysis on a beneficiary, plan, prescriber, or pharmacy level without disclosure of the actual identifying information. CMS will link our data to other data files, to the extent feasible, to minimize the extent to which other parties need identifiers for data linkage purposes. CMS has the sole authority to determine whether a particular data element is needed for a request.
Beneficiary ID (HIC Number, Cardholder ID, Patient date of birth) See Note 2	Encrypted, but available if needed	Encrypted, but available if needed	Encrypted, but available if needed to link to another dataset.
Plan ID (PBP identifier, Contract identifier) See Note 3	Encrypted, but available if needed	Encrypted, but available if needed	Encrypted.
	Additionally, nonencrypted data will be available for purposes of performance measures
Prescriber ID (Prescriber Identifier) See Note 4	Encrypted, but available if needed	Encrypted, but available if needed	Encrypted, but available if needed to link to another dataset.
	Additionally, nonencrypted data will be available for purposes of performance measures
Pharmacy ID (Service provider identifier) See Note 5	Encrypted, but available if needed	Encrypted, but available if needed	Encrypted, but available if needed to link to another dataset.
Qualifying Identifiers (Service & Prescriber Identifier Qualifiers—codes that denote whether NPI, NCPDP, UPIN, state license number, DEA, or non-standard code is used)	Available	Available	Available.
Internal plan/pharmacy prescription identification numbers (Claim Control Number—a code intended for the plan to identify unique events & Prescription Service Reference Number—a code assigned by the pharmacy at the time the prescription is filled)	Available	Unavailable	Unavailable.
Drug Utilization Information
Date of Service	Available	Available	Available.
Drug information (Product/Service Identifier, Quantity Dispensed, Days Supply, Compound Code, Fill Number, Dispensing Status.)	Available	Available	Available.
Other utilization information (Dispense as Written/Product Selection Code, Drug Coverage Status Code)	Available	Available	Available.
Drug Cost Information
Total Drug Costs (Ingredient Cost, Dispensing Fee, Total Amount Attributable to Sales Tax) See Note 6	Available, Disaggregated	Available, Aggregated	Available, Aggregated.
Coverage Information
Date Paid	Available	Available	Available.
Plan Paid Amounts (Covered D Plan Paid Amount, Non-covered Plan Paid Amounts)	Available	Available	Available.
Beneficiary cost sharing (Patient Pay Amount,)	Available	Available	Available.
Other Payer Amounts (Other True Out of Pocket Amount, Patient Liability due to Other Payer Amount)	Available	Available	Available.
Low-Income Subsidy Amount	Available	Available	Available.
Other Financial Information (Gross Drug Cost below Out-of-pocket Threshold, Gross Drug Cost above Out-of-pocket Threshold)	Available	Available	Available.
Other Descriptive Data
Patient gender	Available	Available	Available.
Catastrophic Coverage Indicator (Catastrophic Coverage Code)	Available	Available	Available.
In-network versus OON or MSP claim (Pricing Exception code)	Available	Available	Available.
Electronic versus Paper Claim (Non-Standard format Code)	Available	Available	Available.
Original versus Adjusted PDE (Adjustment/Deletion code)	Available	Final Action claims would be provided, so this element should not be needed	Final Action claims would be provided, so this element should not be needed.
Generally, the notes apply to all columns across the row.
Note 1—Congressional oversight agencies include GAO, MedPAC, and CBO. CRS is considered a Congressional oversight agency, but only when acting on behalf of a committee pursuant to its authority in 2 U.S.C. § 166(d)(1). Otherwise, CRS is considered to be an external entity. Note also that OIG has authority independent of both sections 1860D-12 and 1860D-15 of the Social Security Act to collect data.
Note 2—CMS will encrypt all beneficiary identifiers unless they are needed. An example of where they might be needed is linkage to another dataset. When CMS sends real identifiers in order to permit the requestor to link files, CMS will encrypt identifiers during transmission, provide a link key to unencrypt the files, allow the linkage, and then require the requestor to re-encrypt identifiers. Public disclosure of research results will not include beneficiary identifying information.
Note 3—In general, CMS will link the Part D claims to plan level benefits and formulary data if needed by the requestor, and then encrypt the plan ID. However, CMS will not link certain information if it will lead to a de facto identification of the plan. CMS may develop plan specific performance measures which are publicly reported.
Note 4—CMS will link to physician characteristics from CMS files if needed by the requestor. Generally, when CMS sends real identifiers in order to permit the requestor to link files, CMS will encrypt identifiers during transmission, provide a link key to unencrypt the files, allow the linkage, and then require the requestor to re-encrypt identifiers.
Note 5—To the extent available, CMS will provide pharmacy characteristics from CMS files. However, CMS will not release pharmacy ID, together with drug cost information, in order to guard against the disclosure of negotiated price information.
Note 6—Generally, CMS will aggregate ingredient cost, dispensing fee, and sales tax at the individual claim level. Upon request, CMS will exclude sales tax from the aggregation at the individual claim level if necessary for the project.

Footnotes

1.  We note that there are other provisions outside of section 1860D-15 of the Act that also contain payment provisions. For example, section 1860D-14 of the Act discusses how CMS pays the low-income subsidy.