PDF Final Part D Claims Data Reg

7/30/2019 PDF Final Part D Claims Data Reg

1/23VerDate Aug2005 16:52 May 27, 2008 Jkt 214001 PO 00000 Frm 00001 Fmt 4717 Sfmt 4717 E:\FR\FM\28MYR2.SGM 28MYR2

Wednesday,

May 28, 2008

Part II

Department ofHealth and HumanServicesCenters for Medicare & Medicaid Services

42 CFR Part 423

Medicare Program; Medicare Part DClaims Data; Final Rule


2/23

VerDate Aug2005 16:52 May 27, 2008 Jkt 214001 PO 00000 Frm 00002 Fmt 4701 Sfmt 4700 E:\FR\FM\28MYR2.SGM 28MYR2

30664 Federal Register / Vol. 73, No. 103 / Wednesday, May 28, 2008 / Rules and Regulations

DEPARTMENT OF HEALTH ANDHUMAN SERVICES

Centers for Medicare & MedicaidServices

42 CFR Part 423

[CMS4119F]

RIN 0938AO58

Medicare Program; Medicare Part DClaims Data

AGENCY: Centers for Medicare &Medicaid Services (CMS), HHS.ACTION: Final rule.

SUMMARY: This final rule allows theSecretary to collect claims data that arepresently being collected for Part Dpayment purposes for other research,analysis, reporting, and public healthfunctions. The Secretary needs to usethese data because other publicly

available data are not, in and ofthemselves, sufficient for the studiesand operations that the Secretary needsto undertake as part of the Departmentof Health and Human Servicesobligation to oversee the Medicareprogram, protect the publics health,and respond to Congressional mandates.These data will also be used to betteridentify, evaluate and measure theeffects of the Medicare ModernizationAct of 2003, (MMA).DATES: Effective Date:This regulation iseffective June 27, 2008. Date ofApplicability:This regulation applies to

Part D claims data collected on or afterJanuary 1, 2006. Following the effectivedate of this final rule, we will recollectunder section 1860D12(b)(3)(D) of theAct any data that were first submittedprior to the effective date of this finalrule by extracting them from the Part Dclaims data already collected forpayment purposes.FOR FURTHER INFORMATION CONTACT:Alissa DeBoy, (410) 7866041; NancyDeLew, (202) 6907351.SUPPLEMENTARY INFORMATION: Copies: Toorder copies of the Federal Registercontaining this document, send your

request to: New Orders, Superintendentof Documents, P.O. Box 371954,Pittsburgh, PA 152507954. Specify thedate of the issue requested and enclosea check or money order payable to theSuperintendent of Documents, orenclose your Visa or Master Cardnumber and expiration date. Credit cardorders can also be placed by calling theorder desk at (202) 5121800 (or toll freeat 18882936498) or by faxing to(202) 5122250. The cost for each copyis $10. As an alternative, you can viewand photocopy the Federal Register

document at most libraries designatedas Federal Depository Libraries and atmany other public and academiclibraries throughout the country thatreceive the Federal Register. ThisFederal Register document is alsoavailable from the Federal Registeronline database through GPO Access, aservice of the U.S. Government Printing

Office. The Web site address is: http://www.access.gpo.gov/fr/index.html.

I. Background

A. Requirements for Issuance ofRegulations

Section 902 of the MedicarePrescription Drug, Improvement, andModernization Act of 2003 (MMA) (Pub.L. 108173) amended section 1871(a)(3)of the Social Security Act (the Act) andrequires the Secretary, in consultationwith the Director of the Office ofManagement and Budget (OMB), toestablish and publish timelines for the

publication of Medicare finalregulations based on the previouspublication of a Medicare proposed orinterim final regulation. Section1871(a)(3)(B) of the Act also states thatthe timelines for these regulations mayvary, but shall not exceed 3 years afterpublication of the preceding proposedor interim final regulation, except underexceptional circumstances. This finalrule finalizes provisions set forth in ourOctober 18, 2006 proposed rule. Inaddition, this final rule is beingpublished within the 3-year time limitimposed by section 1871(a)(3)(B) of the

Act. Therefore, we believe that the finalrule is in accordance with theCongresss intent to ensure timelypublication of final regulations.

B. General Overview

As stated in the October 18, 2006proposed rule, under the Act, theSecretary has the authority to include inPart D sponsor contracts any terms orconditions the Secretary deemsnecessary and appropriate, includingrequiring the organization to provide theSecretary with such information as theSecretary may find necessary and

appropriate. (See section 1857(e)(1) ofthe Act as incorporated into Part Dthrough section 1860D12(b)(3)(D) ofthe Act.)

We proposed to implement section1860D12(b)(3)(D) of the Act to allowthe Secretary to collect the same claimsinformation now collected under theauthority of section 1860D15 of the Actfor purposes including reporting to theCongress and the public, conductingevaluations of the overall Medicareprogram, making legislative proposals toCongress, and conducting

demonstration projects. While thepurposes underlying such collection arediscussed in more detail in this finalrule, they include, but are not limitedto, evaluating the effectiveness of thenew prescription drug benefit and itsimpact on health outcomes, performingCongressionally mandated or otherdemonstration and pilot projects and

studies, reporting to Congress and thepublic regarding expenditures and otherstatistics involving the new Medicareprescription drug benefit, studying andreporting on the Medicare program as awhole, and creating a research resourcefor the evaluation of utilization andoutcomes associated with the use ofprescription drugs.

We note that because this final ruleapplies to all Part D sponsors, it appliesto any entity offering a Part D plan,including both prescription drug plansponsors and Medicare Advantageorganizations offering qualified

prescription drug coverage. We furthernote that the Part D prescription drugevent data (hereinafter also referred toas Part D claims data) collected inaccordance with section 1860D12(b)(3)(D) of the Act will include 37drug claim elements submitted by drugplan sponsors to the Secretary, which inaccordance with 423.100, include notonly data from claims for drugs, but alsodata from claims for insulin, biologicalproducts, certain medical supplies, andvaccines.

II. Provisions of the Proposed RuleWith an Analysis of and Response to

Public CommentsWe received approximately 118 items

of timely correspondence containingcomments on the October 18, 2006proposed rule. Commenters includedhealth policy organizations, pharmaciesand pharmacy-related organizations,members of the Congress, researchers,insurance industry representatives,physicians and other health careprofessionals, beneficiary advocacygroups, representatives of hospitals, PartD beneficiaries, a pharmacy benefitmanagers trade association and others.

In this final rule, we address all

comments and concerns on the policiesincluded in the proposed rule. Thefollowing lists the provisions of theproposed rule that received the mostcomments:

External access to the data Uses for the data Privacy protections for the dataGenerally, the vast majority of

commenters expressed strong supportfor the proposed rule, declaring itessential for the success and accurateevaluation of the Medicare Part Dprogram. There was also a significant
http://www.access.gpo.gov/fr/index.htmlhttp://www.access.gpo.gov/fr/index.html


3/23


Federal Register / Vol. 73, No. 103 / Wednesday, May 28, 2008 / Rules and Regulations 30665

amount of agreement among thecommenters that external entities beallowed access to Part D claims data.Commenters pointed out that CMScould not possibly fund all the researchneeded, and because of that, allowingexternal entities access to these data isnecessary in order to evaluate the manyhealth care issues arising from the new

prescription drug benefit. Commentersalso noted that research by externalentities is likely to result in lowergovernment expenditures and betterdelivery of health care to beneficiaries.Many of the commenters supporting therule cited multiple examples of thepotential benefits to the public healththat could result with the access to PartD claims data by qualified organizationsand individuals, including assessing theimpact prescription drugs have on thehealth outcomes of the elderly, costefficiencies, quality of care measures,and the efficacy of prescription drugs.

A number of comments addressedprivacy protections, which impact thecollection and release of claims data,and other commenters expressedconcern about sensitive financialinformation being released. Themajority of commenters acknowledgedthat a risk to protected informationexists; however, they believed that therisk is no greater than the risk involvedwhen allowing access to currentlyavailable Medicare data.

Several commenters raised concernsabout the inherent limitationsassociated with the use of claims datafor research purposes and requested thatwe acknowledge these limitations. Inthe following sections, we address all ofthese comments.

A. General Provisions

1. Statutory Basis

On December 8, 2003, the Congressenacted the Medicare Prescription Drug,Improvement, and Modernization Act of2003 (MMA) (Pub. L. 108173). Title Iof the MMA amended the Act toestablish a new voluntary prescriptiondrug benefit program, Medicare Part D.As we stated in the preamble to the

January 28, 2005 final rule (70 FR 4197)implementing the new prescription drugbenefit, we believe that the addition ofoutpatient prescription drug coverage tothe Medicare program is the mostsignificant change to the Medicareprogram since its inception in 1965.

Unlike Parts A and B of the Medicareprogram, where Medicare acts as thepayer and insurer and generally pays foritems and services on a fee-for-service

basis, the prescription drug benefit isbased on a private market model. Underthis model, CMS contracts with private

entitiesprescription drug plan (PDP)sponsors, Medicare Advantage (MA)organizations, as well as other types ofMedicare health organizationswhothen act as the payers and insurers forprescription drug benefits. These privateentities are generally referred to as PartD sponsors in our rules. Section1860D12 of the Act contains the

majority of provisions governing thecontracts CMS enters into with the PartD sponsors. That section, entitled,Requirements for and contracts withprescription drug plan (PDP) sponsors,incorporates by reference many of thecontract requirements that previouslywere applicable to Medicare Advantageorganizations.

One of the incorporated provisions atsection 1860D12(b)(3)(D) of the Act, issection 1857(e)(1) of the Act, whichprovides broad authority for theSecretary to add terms to the contractswith Part D sponsors, including terms

that require the sponsor to provide theSecretary with such information * * *as the Secretary may find necessary andappropriate. We believe that the broadauthority of section 1860D12(b)(3)(D)of the Act authorizes us to collect mostof the information we currently collectto properly pay sponsors under thestatute. However, section 1860D15 ofthe Act contains provisions that might

be viewed as limiting such collection.Therefore, we engaged in thisrulemaking in order to resolve thestatutory ambiguity, as well as toimplement the broad authority ofsection 1860D12(b)(3)(D) of the Act.

Most of the payment provisions withrespect to Part D sponsors are found insection 1860D15 of the Act.1

Subsections (d) and (f) of section1860D15 of the Act authorize theSecretary to collect any information heneeds to carry out that section.However, those subsections also statethat information disclosed or obtainedunder [section 1860D15 of the Act]may be used by officers, employees, andcontractors of the Department of Healthand Human Services only for thepurposes of, and to the extent necessaryin, carrying out [section 1860D15 of

the Act]. (Sections 1860D15(d)(2)(B)and (f)(2) of the Act).In the January 28, 2005 Medicare

prescription drug benefit final rule (70FR 4399), we stated that the section1860D15 of the Act restriction appliesonly in cases where section 1860D15 ofthe Act is the authority for collecting theinformation. When information is

1We note that there are other provisions outsideof section 1860D15 of the Act that also containpayment provisions. For example, section 1860D14 of the Act discusses how CMS pays the low-income subsidy.

collected under an independentauthority (even if the collectedinformation duplicates the datacollected under section 1860D15 of theAct) the restrictions under 1860D15 ofthe Act would not apply. In the January28, 2005 final rule (70 FR 4399), wenoted that because quality improvementorganizations (QIOs) have independent

authority to collect Part D claims data inorder to evaluate the quality of servicesprovided by Part D sponsors, QIOswould not be barred from collectingsuch data despite the restrictions ofsection 1860D15 of the Act. We referreaders to the October 18, 2006proposed rule for the exact citation tothe discussion in the January 28, 2005final rule (71 FR 61447). Similar to thestatutory provisions authorizing QIOs tocollect the information they need toperform their statutory duties, section1860D12(b)(3)(D) of the Act recognizesthat the Secretary will need to collect a

broad array of data in order to properlycarry out his responsibilities as head ofthe Department of Health and HumanServices (DHHS). Thus, if the Secretarydetermines it is necessary andappropriate under section 1860D12 ofthe Act for him to collect Part D claimsdata in order to carry outresponsibilities outside section 1860D15 of the Act, then section 1860D15 ofthe Act would not serve as animpediment to such collections.

As stated in the October 18, 2006proposed rule, we also believe thatlanguage in sections 1860D12(b)(3)(D)and 1857(e)(1) of the Act indicating that

the authority to collect informationexists only except as otherwiseprovided, and in a manner that is notinconsistent with this Part, would notserve as a hindrance to the independentcollection of Part D claims data, sinceon its face, section 1860D15 of the Actrestricts use of information only whencollected under that authority.

As we stated in the proposed rule, theCongress most likely included the broadgrant of authority in section 1860D15of the Act in order to ensure that theSecretary, without engaging in anyrulemaking, would have the legislative

authority to collect any necessary datain order to pay Part D sponsorscorrectly. However, we do not believethat the Congress intended to restrict theSecretary when the Secretary otherwisehas independent authority to collectidentical information to that collectedunder section 1860D15 of the Act.Rather, we noted that the Secretary willneed to evaluate Part D claimsinformation in order to determine howaccess to Part D drug benefits affects

beneficiary utilization of services underParts A and B of the Medicare program.


4/23



Specifically, when Congress enacted theMMA, one of the stated reasons was toensure that by lowering the cost ofcritical prescription drugs, seniors will

better be able to manage their healthcare, and ultimately live longer,healthier lives. (Press Release, HouseWays and Means Committee, SeniorsWait for Affordable Rx Drugs Comes to

an End. President Bush Signs HistoricMedicare Bill into Law (December 8,2003) (available at http://waysandmeans.house.gov/news.asp )).In order to determine whether loweringthe costs of prescription drugs actuallyreduces health expenditures orimproves health outcomes for

beneficiaries, the Secretary will need tomatch individual level Parts A and Bdata with Part D claims data. In thisway, the Secretary will be able toevaluate the effectiveness and efficiencyof the Part D benefit and report to theCongress and others on the progress of

the program.We are required to report to theCongress regarding whether mandateddisease management demonstrations are

budget neutral and whetherbeneficiaries in these demonstrationsare on the appropriate medications. Aswe stated in the preamble of theproposed rule we may also need tomake reports under the Part D program,for example, the publication of statisticsdetailing aggregate Medicare and

beneficiary spending by class of drug,average number of drugs used by

beneficiaries, total Medicare programspending, and other similar statistics. In

order to derive such statistics, we wouldneed to use Part D claims data. In theproposed rule, as well as in this finalrule, we outlined a wide variety ofsituations in which it will be necessaryand appropriate for CMS to evaluatethe same information collected undersection 1860D15 of the Act, eventhough such information would not beused to implement section 1860D15 ofthe Act. In these situations, we believethe clear language of section 1860D12(b)(3)(D) of the Act provides theauthority to collect the necessaryinformation, and nothing about such

collection will be inconsistent or inconflict with any other part of thestatute.

In addition, as discussed in thispreamble, we are adding section 1106 ofthe Act as a statutory basis for this finalrule, as that section authorizes release ofdata by the agency through regulation.

Comment:Some commenters statedthat the proposed rule was inconsistentwith the statute. Commenters alsoasserted that the collection is neithernecessary nor appropriate, and somecontended that the rule would

improperly allow the release ofproprietary data.

Response:We refer readers to ourdiscussion of the statutory basis in boththe proposed rule (71 FR 61446) and insection II.A.1. of this final rule. Asnoted in the proposed rule, section1860D12(b)(3)(D) of the Act (and itsincorporation of section 1857(e)(1)) of

the Act provide broad authority to theSecretary to require Part D sponsors toprovide the Secretary with suchinformation as the Secretary may findnecessary and appropriate. In addition,sections 1860D15(d)(2)(B) and (f)(2) ofthe Act, by their own terms, restrictinformation only when disclosed orobtained under the provisions of[section 1860D15 of the Act]. Thus,we continue to believe that wheninformation is collected through astatutory authority independent ofsection 1860D15 (such as in the case ofQIOs, who have independent authority

to collect data) the restrictions of section1860D15 of the Act would not apply,and nothing about the collection or useof the claims data would create aninconsistency or conflict in the statute.

We also believe the collection ofclaims data under section 1860D12 ofthe Act is both necessary andappropriate for the reasons discussed inthe proposed rule and in this final rule.For example, the collection of suchclaims data will permit the Secretary toconduct high level, internal analyses ofthe Part D benefit, such as which drugsare commonly used by the Medicarepopulation, the utilization of generic

drugs in the Part D benefit, the effect ofbenefit design on catastrophic costs(costs for which reinsurance isavailable), the number of individualswho entered the catastrophic phase ofthe benefit, and many more types ofanalysis. Similarly, the Secretary willhave the opportunity to crosswalk PartD claims data to Parts A and B data inorder to analyze the effect of access toprescription drugs on utilization underhospital and supplementary medicalinsurance.

We know that one of the statedreasons for the drug benefit was to

modernize Medicare and ensure thatbeneficiaries were not enduringunnecessary hospitalizations due tofailure to access preventive prescriptiondrug regimens. At the time theprescription drug benefit was beingenacted into law, then-chairman of theSenate Finance Committee, SenatorCharles Grassley, stated:

[T]his bill is about enhancing quality of life* * *. Today, the practice of medicineanda lot of the thanks can go to prescriptiondrugsis to keep people out of hospitals andout of operating rooms. So people who

cannot afford drugs, who go to the doctorvery sick, are going to not only end up in aplace they do not want to go, because peoplewould rather not go to hospitals, rather notgo to operating rooms. It is going to save ourprograms a lot of money, both private andpublic payment programs, for doctors andhospitals, when we can have people go intoprograms where they can get prescriptiondrugs and keep their health up so they do not

go to the hospital.(Medicare Prescription Drug, Improvement,

and Modernization Act of 2003ConferenceReport, 149 Cong. Rec. S1588203, *S15883and S15884 (November, 25, 2003)).

Access to Parts A, B, and D claimsdata will allow the Secretary to analyzethe prescription drug utilization ofchronically ill patients over time, anddetermine whether increases inprescription drug utilization do, in fact,result in fewer hospitalizations. This isthe type of analysis we believe theCongress expected the Secretary toengage in, and such analysis is both

necessary and appropriate under thelaw.Finally, in response to concerns about

releasing proprietary data to externalentities as a result of this rulemaking,we note that data which could affectMedicare program spending, such asrebates, bids, reinsurance, and risk-sharing data, are not part of thisrulemaking. In addition, as discussedlater in this preamble, this rulemakingplaces certain limitations on data whenreleased outside of CMS. We believethat it is in the interest of public healthto share information collected under the

regulations promulgated by this rulewith entities outside of CMS forlegitimate research, or in cases of othergovernmental agencies, for purposesconsistent with their mission. Throughthe application of our minimum datanecessary policy, with some additionalrestrictions to protect beneficiaryconfidentiality and commerciallysensitive data of Part D sponsors, andour data sharing procedures (whichensure the agencys compliance with theHealth Insurance Portability andAccountability Act of 1996 (HIPAA), thePrivacy Act of 1974, and otherapplicable laws), we will limit the useand disclosure of Part D claims data toensure that the data are only used ordisclosed as permitted or required byapplicable law, and not inappropriatelydisclosed in a manner which couldundermine the competitive nature of thePart D program.

Comment:One commenter requestedthat CMS postpone implementation ofthis regulation until the Congressclarifies CMSs statutory authority andthat CMS answer certain questions in asecond posting for comment.


5/23



Response:We believe we have theauthority to collect Part D claims dataunder sections 1860D12 and 1860D15of the Act, and to disclose Part D claimsdata collected under section 1860D12of the Act, in accordance with section1106 of the Act. This final rule issufficiently related to the proposals inthe proposed rule, which were the

subject of vigorous review and commentby the public, and we are not postingthe proposal for a second round ofcomments.

Comment:One commenter questionedwhy we were equating collecting datawith accessing data.

Response:As stated in both theproposed rule and this final rule, inorder to ensure that Part D sponsors arenot required to submit a second set ofthe same data already collected undersection 1860D15, we would collect thedata that are the subject of this final rule

by extracting them from Part D claims

data already collected for paymentpurposes. This is the same approach weused when we discussed QIO access todata in the January 28, 2005 Part D finalrule (70 FR 4399), where we stated thatto the extent QIOs need access to datafrom the transactions betweenpharmacies and Part D sponsors, thesedata could be extracted from the claimsdata submitted to us. Thus, in thepreamble to this final rule, as in thepreamble to the proposed rule (71 FR61447), we may refer to accessingrather than collecting Part D data.

2. Information To Be Collected

In the proposed rule, we proposed toindependently collect the same claimsinformation collected under section1860D15 of the Act under the authorityof section 1860D12(b)(3)(D) of the Act.The Part D claims data for 2006 and2007 includes 37 data elements. Wereferred readers to the Prescription DrugEvent data instructions which can beaccessed at http://www.cms.hhs.gov/DrugCoverageClaimsData/01_PDEGuidance.asp#TopOfPage for afull description of this information.

These instructions define each dataelement and its specific potential use forCMSs payment process. Generallystated, these data elements include thefollowing:

Identification of the Part D sponsorand Part D plan through contractnumber and plan benefit packageidentification number.

Health insurance claim number,which identifies the particular

beneficiary receiving the prescription. Patient date of birth and gender. Date of service. Date paid by the plan.

Identification of pharmacy wherethe prescription was filled.

Identification of prescribing healthcare professional.

Identification of dispensed productusing national drug code (NDC) number.

Indication of whether drug wascompounded or mixed.

Indication of prescribersinstruction regarding substitution ofgeneric equivalents or order todispense as written.

Quantity dispensed (for example,number of tablets, grams, milliliters, orother unit).

Days supply. Fill number. Dispensing status and whether the

full quantity is dispensed at one time,or the quantity is partially filled.

Identification of coverage status,such as whether the product dispensedis covered under the plan benefitpackage or under Part D or both. Thiscode also identifies whether the drug is

being covered as part of a Part Dsupplemental benefit.

Indication of whether uniquepricing rules apply, for example becauseof an out-of-network or Medicare asSecondary Payer services.

Indication of whether beneficiaryhas reached the annual out-of-pocketthreshold, which triggers reduced

beneficiary cost-sharing and reinsurancesubsidy.

Ingredient cost of the productdispensed.

Dispensing fee paid to pharmacy. Sales tax. For covered Part D drugs, theamount of gross drug costs that are both

below and above the annual out-of-pocket threshold.

Amount paid by patient and notreimbursed by a third party (such ascopayments, coinsurance, ordeductibles).

Amount of third party payment thatwould count toward a beneficiarys trueout-of-pocket (TrOOP) costs in meetingthe annual out-of-pocket threshold, suchas payments on behalf of a beneficiary

by a qualifying State PharmaceuticalAssistance Program (SPAP).

Low income cost sharing subsidyamount (if any).

Reduction in patient liability due tonon-TrOOP-eligible payers paying on

behalf of the beneficiary. This wouldexclude payers whose payments counttoward a beneficiarys true out of pocketcosts, such as SPAPs.

Amounts paid by the plan for basicprescription drug coverage and amountspaid by plan for benefits beyond basicprescription drug coverage.

In 2008, the number of elementscollected in the Part D claims data was

expanded from 37 to 39. Specifically,we added additional elements to reflectthe estimated rebate amount applied tothe point-of-sale price and the vaccineadministration fee. Because theseelements were added for 2008, theywere not addressed in the October 18,2006 proposed rule. Furthermore, in theOctober 2006 proposed rule (71 FR

61447), we did not explicitly discusshow we would respond to futurechanges in the elements collected aspart of the claim. Rather, the proposedrule included only a discussion of the37 elements that then comprised thePart D claim and proposed that wewould collect these 37 elements undersection 1860D12(b)(3)(D) of the Act. Asa result, interested parties had anopportunity to comment only upon ourproposal to collect the original 37elements of the Part D claim undersection 1860D12(b)(3)(D) of the Act,and there has not been any similar

opportunity for interested parties tosubmit comments on whether the twonew elements should also be collectedunder section 1860D12(b)(3)(D) of theAct, such that they may also be used fornon-payment-related purposes.Accordingly, we will not be collectingthese two data elements under section186012(b)(3)(D) of the Act at this time.We are finalizing a regulationestablishing our authority to collectunder section 1860D12(b)(3)(D) of theAct only those 37 data elements thatwere part of the prescription drug event(PDE) record in 2006. Data regarding

these 37 elements may be used for bothpayment-related and nonpayment-related purposes. As discussed later inthis preamble, such use will be subjectto our minimum necessary data policy,our data sharing procedures, and theencryption of certain identifiers andaggregation of cost data to protect

beneficiary confidentiality andcommercially sensitive data of Part Dsponsors. Because data regarding the38th and 39th elements will continue to

be collected only under section 1860D15(d)(2) and (f)(1) of the Act, consistentwith 423.322(b), these data may beused only for payment-related purposes.

We note that this final rule does notextend to rebate or other priceconcession data, otherwise known asdirect or indirect remuneration orDIR, with the exception of DIR thatmay be reflected in the negotiated pricepaid for a drug at the point of sale.Again, the collection of Part D dataunder the authority of section 1860D12of the Act in accordance with this finalrule, is limited to the original 37 dataelements collected as part of the Part Dclaims data. We have clarified this in
http:///reader/full/http://www.cms.hhs.govhttp:///reader/full/http://www.cms.hhs.gov


6/23



response to comments and in theregulatory text.

Comment:Commenters weregenerally supportive of CMSs proposalto access Part D claims data for researchand non-research purposes, and agreedthat the data will provide valuableinformation and be essential in theevaluation of the Part D benefit. Several

commenters requested additionalelements be added to the original 37PDE elements outlined in the proposedrule.

Response:We agree that the PDE dataelements we now collect will provide avaluable tool for evaluating the Part Dprogram, and appreciate the suggestionsto add other elements for collection.This final rule is first and foremost aclarification of the statutory authoritythat allows us to collect the original 37PDE elements outlined in the proposedrule and this final rule and to accessthem for purposes other than payment.Since these data are already beingcollected under the Part D program, wewould access the already-collected dataand make them available for researchand non-research purposes, withoutundue burden to Part D sponsors or

beneficiaries.As discussed above, in 2008, the

number of PDE data elements wasexpanded to 39. In future years, we mayrevise our guidance on PDE Reporting toinclude additional elements on theclaim beyond the elements presentlycollected. Through separate rulemaking,we will address whether we intend tocollect any of these additional elements

under our authority in section 1860D12(b)(3)(D) of the Act.

Comment:Several commenters notedthat the proposed rule relates to drugclaims and related information andasked for clarification as to what ismeant by this phrase. A fewcommenters noted that the presence ofthis phrase in the proposed regulatorytext suggests that CMS may becontemplating using and sharing rebateand other discount and pricingconcession data.

Response:Rebate and other priceconcession data are not the subject of

this final rule. This rulemaking appliesto Part D claims data only, and islimited to the original 37 elementsreported on the PDE. To further clarifythis point we are amending proposed 423.505(f)(3) to delete the applicablereference to related information.

Comment:Several commentersexpressed concern about access to costand pricing data. Several commentersnoted that pricing data contained on thePart D claim are not an accuratereflection of the actual costs to plans.These commenters also requested

clarification that the information we areproposing to collect and disclose relateonly to Part D claims data, and not tocompetitively sensitive financial dataregarding rebates, discounts or othernegotiated price concessions. Thecommenters expressed a concern thatrelease of competitively sensitive datacould undermine the competitive bid

process. They assert that plans will beable to adjust their bids on the basis ofknowledge of each others data,resulting in higher drug costs for all.

Response:We share the commentersconcerns about the need to protect thesensitive data under the Part D program.Because the Medicare drug benefit is

based on a competitive business model,to release commercially or financiallysensitive data to the public couldnegatively impact Part D sponsorsability to negotiate for better prices, andultimately affect the ability of sponsorsto hold down prices for beneficiaries

and taxpayers. Therefore, we haveadopted a number of protections tomitigate these concerns.

First, we have clarified that this finalrule applies only to the 37 originalelements of Part D claims data and notto rebate and other price concessionsdata. As discussed above, to the extentthat the PDE record was amended in2008 to include data on estimatedrebates applied at the point of sale, wehave clarified it in the regulation thatwe will not be collecting thisinformation under that authority. Inaddition, we note that plan-specific bid

information is not included on theclaim, and therefore, would not be thesubject of this rulemaking.

Second, with respect to ourdisclosures of information collectedunder this rulemaking to externalentities, we have developed anapproach to minimize the risk ofunauthorized disclosure of beneficiaryidentifiable information, as well as theuse of commercially sensitive data ofPart D sponsors. Similar to the processused under Parts A and B program:

We will require research usingbeneficiary identifiable data to beconducted by an experienced entity at areputable organization, with anappropriate research design, and withassurances to protect beneficiaryconfidentiality. Research is to be madeavailable to the public and identifiabledata is not released for commercialpurposes.

We will only release beneficiaryidentifiable data for research purposes ifthe CMS privacy board approves thedata release and then, will only releasethe minimum data necessary for thestudy.

Requesters who receive identifiersto link to another dataset will berequired to re-encrypt beneficiaryidentifiers, after data linkage, tominimize the risk of accidentaldisclosure.

Requesters will sign a data useagreement which carries penalties formisuse or intentional release of

beneficiary identifiable information.In addition to these protections of

beneficiary identifiable information, weplan to impose additional restrictions tofurther protect beneficiaryconfidentiality and plan commerciallysensitive information. When releasingdata to external entities, we will restrictreleases according to the followingprinciples:

Only the minimum necessaryelements from the PDE will be releasedfor a project. In accordance with thisprinciple, cost data will not be releasedunless necessary for the project.

Drug cost elements (that is,ingredient cost, dispensing fee, andsales tax) will be aggregated.

Beneficiary identifiers, pharmacyidentifiers and prescriber identifierswill be encrypted where not needed tolink to other datasets. Additionally, anelement representing the internalprescription service reference numberassigned by pharmacies will not bereleased so as to not indirectly revealpharmacy identifiers.

Plan identifiers will always beencrypted for external entities. We notethat the internal plan identificationnumbers on the claim would also not be

available to external entities as theserepresent reference numbers assigned bythe plan at the time a drug is dispensedand release of such numbers could leadto a de facto identification of the plan.We also note that when we state in thispreamble that an identifier will beencrypted, this means that it will bereplaced with a non-identifiable numberor code such that there is a lowprobability of assigning any meaning tothe replacement number or code. Unlessotherwise noted, encryption will occurwithout any decryption, and we wouldnot provide a key that allows for anencrypted identifier to be converted

back into its original form. We believethese restrictions will protect both thecommercially sensitive data of Part Dplans, such as the plan identifiers,pharmacy identifiers, prescriberidentifiers and cost elements, as well asthe beneficiary identifiable dataincluded on the claim. Similarprotections for both beneficiaryidentifiable information as well ascommercially sensitive data of Part Dsponsors will be in place for releases togovernmental entities as well including


7/23



States, Congress and other executivebranch agencies. For both States andnon-HHS executive branch agencies, thedrug cost elements on the claim(ingredient cost, dispensing fee, andsales tax) will be aggregated together,and will not be available in adisaggregated format, except that, uponrequest, CMS will exclude sales tax

from the aggregation at the individualclaim level if necessary for the project.We believe this aggregation will serve toensure that some of the mostconfidential data on the claimtheseparate costs paid by Part D sponsorsfor ingredient cost or dispensing feewill not be vulnerable to anyunauthorized release. However, becausethese government agencies may needother data on the claim in order tocoordinate treatment of beneficiaries orfurther study care received byindividual beneficiaries, we will makethe beneficiary, plan, pharmacy, and

prescriber identifiers available to theseentities where needed. For example, asdiscussed later in this preamble, Stateshave specifically requested claims datafor beneficiaries dually eligible forMedicaid and Medicare. Byunderstanding the care received bythese beneficiaries, the State Medicaidagencies may be able to bettercoordinate the medical costs theyreimburse under Medicaid with thedrug regimens being reimbursed underthe Medicare Part D program. Incoordinating care, these State agenciesmay need to understand which plan a

beneficiary is enrolled in. Releases to

Congressional oversight agencies arediscussed in response to comment laterin this preamble. We have includedthese restrictions in our amendedregulations at 423.505(m).

The appendix to this rule alsocontains a CMS chart, explaining inmore specific detail the restrictionsrelative to the available PDE elementsfor various parties. We will evaluate allrequests for these data to ensure thatany release is consistent with therestrictions contained in ourregulations, and we will release only theminimum data that are necessary for the

specific project. Additionally, as part ofour data sharing procedures, we willensure that any disclosure is for anappropriate purpose and does notundermine the competitive nature of thePart D program, such as a disclosurethat would result in Part D sponsors

being able to adjust their plan bids onthe basis of knowledge of each othersdata.

Finally, while we agree withcommenters that cost data on the Part Dclaim may not reflect the actual costs toplans, such data does reflect costs

incurred at point-of-sale, and may be ofuse to CMS, other governmental entities,and other external entities for projectsunrelated to a plans total costs.

Comment:One commenter asked thatCMS appropriately use and differentiate

between the terms sex and genderin its data collection process.

Response:The Patient Gender Code

field in the Part D claim is defined bythe National Council of PrescriptionDrug Programs (NCPDP). We have foundit helpful in working with the industryand other stakeholders to rely on theNCPDP industry standard wheneverpossible. The NCPDP data dictionarydefines Gender Code under definitionof field, For eligibility, and identifyingthe gender of the member. Values are:M=Male, F=Female, and U=Unknown.

B. Purpose of CMS CollectingInformation

In the proposed rule, we outlined our

intended use of Part D claims data fora wide variety of statutory and otherpurposes including

Reporting to the Congress and thepublic on the overall statisticsassociated with the operation of theMedicare prescription drug benefit;

Conducting evaluations of theMedicare program;

Making legislative proposals withrespect to the programs we administer,including the Medicare, Medicaid, andthe State Childrens Health InsuranceProgram; and

Conducting demonstration projectsand making recommendations forimproving the economy, efficiency, oreffectiveness of the Medicare program.

In the final rule, we continue tobelieve such uses are necessary andappropriate. In addition, as discussed

below and later in this preamble, wealso intend to use these data for otherstudies addressing public healthquestions, pilot projects,supporting quality improvement andperformance measurement activities,and populating personal healthrecords, and have added thesepurposes to the list in 423.505(f)(3).

Comment:Many commenters believeanalyses of Part D claims data arenecessary for CMS to administer theMedicare program, and for planning,evaluation, and policy development.Examples of program research andevaluation uses suggested bycommenters include

Assuring that Part D has notpromoted adverse selection into certainhealth plans with less generousmedication coverage;

Examining the effects of drugcoverage and cost containment on

Medicare spending and the health ofvulnerable elderly and disabled persons;

Measuring the success ofprescription drug plans in encouragingthe use of generic medicines;

Examining the transition effects ofmoving dual eligibles from Medicaidprograms to Part D;

Analyzing the effects of a coveragegap on drug utilization and spending;

Determining the impact of Part Dcoverage on non-pharmaceuticaltreatments and services use;

Evaluating the effect of changingcopayments, copay structures, andcoverage limits on beneficiary drugchoices and compliance with drugregimens;

Assessing the extent to which riskadjustment methodology influencesenrollment dynamics;

Assessing the impact of adding aprescription drug benefit on healthoutcomes of beneficiaries;

Researching the extent to whichdisparities in care (based on race,socioeconomic status, rural residence,etc.) might be affected by Part D; and

Understanding the impact of Part Don related public programs, such as theState Childrens Health InsuranceProgram (SCHIP), SPAPs, Medicaid, andthe VA.

Commenters also noted that beingable to explore how Part D functions onits own and in relation to other parts ofthe Medicare program is essential toguiding future policy decisions. Theyfurther assert that use of Part D claimsdata is critical to CMSs credibility and

should be considered as part of theSecretarys value-based health carepurchasing initiative. Without access toPart D claims data for research and otherpurposes, CMS will limit its ability tomonitor expenditures for the newprogram, to study the impact of theprogram on public health, and torespond to Congressional requests forinformation.

Response:We agree with the manycomments that Part D claims data will

be essential to us for reporting,conducting program evaluations anddemonstrations, research analyses, and

other public health functions. We alsoagree that research uses of these datashould help promote and protect thehealth and well-being of Medicare

beneficiaries. While we believe theseuses were implied in the regulatory textset forth in the proposed rule, we areexpanding the list of necessary andappropriate purposes for which datawill be collected in this final rule toaddress public health functionsspecifically.

Comment:Commenters expressedwidespread support for using Part D


8/23



claims data to improve our knowledgebase on medication adherence and otheraspects of pharmacotherapy among theelderly and disabled. Some specificsuggested uses of Part D claims data forthis purpose include the following:

Describing current medication useamong the elderly and disabled andexamining trends, specifically

enhancing our awareness of poly-pharmacy, off-label uses, avoidance ofcontraindicated drugs and dangerousdrug-drug interactions.

Examining the extent to whichMedicare beneficiaries receivemedicines according to evidence basedguidelines.

Assessing whether beneficiaries areadhering to prescribed therapy, and ifnot, the clinical and economic impact ofnonadherence.

Testing new interventions toimprove medication prescribing andadherence.

Evaluating the impact of medicationtherapy management programsmandated under the new Medicareprescription drug benefit.

Response:We consider examiningmedication use, inappropriate use, andfactors influencing medicationadherence in the Medicare populationto be crucial aspects of Part D programmonitoring and evaluation, and publichealth. As noted by commenters, theCongress mandated that we examine

best practices of medication therapymanagement, and Part D claims data arecritical for our being able to completethat study.

Comment:A few commenters notedthat sharing of research results is criticalto CMS credibility and should beconsidered part of the transparencyinitiative.

Response:We recognize Part D claimsdata research, and any subsequentresults, are critical to evaluatingmultiple aspects of the MedicarePrescription Drug program. Manyquality measures developed by theAmerican Medical AssociationPhysician Consortium and NationalCommittee for Quality Assurance, andsubsequently adopted by Ambulatory

Care Quality Alliance, and the HospitalQuality Alliance require Part D claimsdata to run the measures. All of thefollowing quality measures involve PartD claims data: Drug Therapy forLowering Cholesterol, Beta-BlockerTherapy within 7 days post myocardialinfarction, and Beta-Blocker therapy at 6months post myocardial infarction.These measures will be used by manyof the Better Quality Information toImprove Care for Medicare BeneficiariesProject pilots, including the new localcollaboratives being chartered under the

Secretarys value-based health careinitiative to foster public reporting. Allof this makes Part D claims data anintegral part of our transparency efforts.Thus, in this final rule, we are clarifyingour intent to use Part D data for thesenecessary and appropriate purposes byadding supporting qualityimprovement and performance

measurement activities as an explicituse of these data under 423.505(f)(3).

Comment:A commenter asserts thatwe did not adequately justify the use ofPart D claims data by the Secretary forpublic reporting purposes, apart from itsuse to develop reports to the Congress,which may become publicly availablerecords.

Response:As we stated in theproposed rule, we believe it isappropriate and necessary for theSecretary to use Part D claims data forthe purposes of reporting to theCongress on the effectiveness and

performance of the prescription drugbenefitincluding reporting that is notrelated to payment. In addition, we mayneed Part D claims data to report to thepublic on aggregate statistics associatedwith the Part D program. Finally, theSecretary has determined that it isnecessary and appropriate, undersection 1860D12 of the Act, that thepublic should have access to certaindata, so that the public may monitor theprogress of the Part D program and, infact, perform research that will improvethe health of, not only Medicare

beneficiaries, but all Americans. This is

why we have created Part D-relatedpublic use files relating to plan benefitsand formularies (for example, files suchas geographic locator files, planinformation files, formulary files,

beneficiary cost files, pharmacy networkfiles, and record layout files asdescribed at http://www.cms.hhs.gov/NonIdentifiableDataFiles/09_PrescriptionDrugPlanFormularyandPharmacyNetworkFiles.asp.). We mayalso create additional public use filessubsequent to the publication of thisfinal rule.

Comment:Several commenterssuggested that the reporting of overallstatistics and development ofevaluations and/or legislative proposalscan be achieved without CMS having touse or disclose the Part D sponsors PartD claims data. The commentersuggested that CMS use information thatis separately collected from the claim todevelop statistics, noting however, thatthis information will not necessarilyallow CMS to do every type of analysisdescribed in the proposed rule.Additionally, CMS could partner withone or more sponsors to use their data,

alone, or in combination, to doadditional statistics and analysis.

Response:Although we are willing topartner with plan sponsors as needed,we do not believe that voluntarycooperation by Part D sponsors wouldprovide the kind of comprehensive datasets we need to perform the research,evaluations, reporting and other

functions that are described this finalrule. Voluntary agreements with plansponsors would lead to an incompletefile of data. In addition, because wepossess the authority under section1860D12(b)(3)(D) of the Act to collectPart D claims data, we do not believe anexclusive reliance on such voluntaryagreements is necessary.

Comment:A commenter noted that arecent Report to Congress recommendedthat the Secretary should have a processin place for the timely delivery of PartD data to congressional support agenciesto enable them to report to the Congresson the drug benefits impact on cost,quality, and access.

Response:We agree that congressionalsupport agencies should have timelyaccess to appropriate Part D data. Thisfinal rule allows congressional oversightagencies access to all elements on thePart D claim in order to carry out theirfunctions. Like other agencies outside ofCMS, such congressional agencieswould be subject to our minimumnecessary policies and data sharingpolicies. Thus, we would release onlythe minimum amount of Part D claimsinformation necessary to support givenprojects. In addition, as discussed later

in this preamble, the CongressionalResearch Service has the authority torequire data releases only when actingon behalf of a committee. Thus, thatagency would be treated the same as acongressional oversight agency whenacting on behalf of committee.Otherwise, it would be subject to thesame restrictions that apply to externalentities in our regulation.

Comment:Several commentersrequested that we establish specific,explicit procedures to ensure that ifcomparative effectiveness or safetyresearch informs coverage or payment

decisions for specific items and services(whether decisions are made by CMS orits agents under Parts A and B or byprivate plans under Part D),stakeholders have an opportunity toevaluate the evidentiary basis ofproposed decisions and provide input.

Response:Since our proposed ruledid not address the development ofnational coverage or payment decisions,

but rather our access to Part D claimsdata, we believe that our developmentof coverage or payment decisions is

beyond the scope of this rulemaking.
http:///reader/full/http://www.cms.hhs.govhttp:///reader/full/http://www.cms.hhs.gov


9/23



We do note that section 1860D4(b)(3)of the Act requires pharmacy andtherapeutic committees to base clinicalformulary decisions on the strength ofthe scientific evidence and standards ofpractice. We have issued furtherformulary guidance available at http://www.cms.hhs.gov/Pharmacy/07_Formulary%20Guidance.asp#

TopOfPage.Comment:Some commenters noted

potential uses for Part D claims data,linked with Parts A and B data, whichextend beyond research into the actualprovision of care, including diseasemanagement.

Response:We believe theimplementation of disease managementprograms and the evaluation of theseprograms could potentially bestrengthened by the use of Part D claimsdata. However, we believe these datamust be used with caution for thesepurposes since we collect Part D claims

data only for Medicare Part D enrollees.We do not collect drug claims data forthose beneficiaries who receive theirdrug insurance solely from othersources, such as employer or retireesponsored health plans, the VeteransHealth Administration, or TRICARE.

Comment:Some commenters notedthat Part D claims data can helpimprove Medicares current basis of riskadjustment for plan payments.

Response:Section 1860D15(d)(2)(B)of the Act provides us authority to usePart D claims data for determiningMedicare payments to prescription drug

plan sponsors. This includes their usefor refining our drug plan paymentsystem. Thus, when claims data areused for risk adjustment they arecollected under section 1860D15 of theAct, and not under section 1860D12 ofthe Act.

Comment:A commenterrecommended adding the phrase andpilot into the text of the 423.505(f)(3)(iv), so that the regulationwould read The Part D plan sponsoragrees to submit to CMS * * * [d]ataincluded in drug claims submitted byPart D plan sponsors, as the Secretarydeems necessary and appropriate forpurposes including but not limited to* * * [(f)(3)(iv) c]onductingdemonstration and pilotprojects andmaking recommendations for improvingthe economy, efficiency, or effectivenessof the Medicare program. Thecommenter wants to ensure thatMedicare Health Support Organizationsare able to access Part D claimsutilization data.

Response:We agree that pilotprojects, as appropriate, should haveaccess to these data, as appropriate, and

have added the phrase and pilot to 423.505(f)(3)(iv).

Comment:Several commentersrequested that the list of purposes forwhich the data would be used beexpanded to include program integrity.

Response:We agree that it isimportant that our program integritycomponents have access to necessary

data in order to protect the program.The existing regulation at 423.322(b)already allows information collectedunder section 1860D15 of the Act to beused in determinations of payments andpayment-related oversight and programintegrity activities. To the extent thatprogram integrity activities may includeinvestigations of issues that are notdirectly payment-related, this rule willprovide access to Part D claims data forthese purposes.

Comment:One commenter requestedwe clarify in the final rule that Part Dclaims data can be used by CMS tooversee and protect the program. Othercommenters stated that we shouldclarify that Medicare Drug IntegrityContractors (MEDICs) can obtain Part Dclaims data where necessary to fullyinvestigate complaints and fraudulentclaims.

Response:Our regulations alreadyaddress use of payment data forpayment-related oversight. We areconstantly working with our MEDICs todetermine the types of data to whichthey will have access. However, we

believe our interactions with ourcontractors involve internal agencyprocedures, and are not the subject of

this final rule.C. Sharing Data With Entities Outside ofCMS (Final 423.505(f)(3) and (l)Through (o))

As stated in the October 18, 2006proposed rule, in addition to collectingPart D claims data for use inadministering the Medicare Part Dprogram under the authority of section1860D12(b)(3)(D) of the Act, we also

believe that it is in the interest of publichealth to share the information collectedunder that authority with entitiesoutside of CMS. When information iscollected under the authority of section1860D12(b)(3)(D) of the Act, we do not

believe that the statutory language insection 1860D15(d) and (f) of the Act(requiring the information collectedunder the authority of that section to beused only in implementing suchsection) would apply, since anycollection would be effectuated outsideof section 1860D15 of the Act.Therefore, as we stated in the October18, 2006 proposed rule, we proposed toadd a new 423.505(f)(5) to theregulations (now 423.505(l) and (m))

that would specify that we could useand share the Part D claims informationwe collect under 423.505(f)(3), withoutregard to any restriction included in 423.322(b). In response to comments,we clarify in this final rule that ourregulation permitting release of Part Dclaims data to other governmentagencies and outside entities is

authorized by section 1106 of the Act.1. Other Government Agencies

We stated in the proposed rule thatthe Department of Health and HumanServices (DHHS) public healthagencies such as the National Institutesof Health (NIH), the Food and DrugAdministration (FDA), and the Agencyfor Healthcare Research and Quality(AHRQ) have, or support, researchersthat would need to use Medicare Part Dprescription drug event data for studies,and other projects, to improve publichealth consistent with the missions ofthese agencies. We also stated thatoversight agencies may need access to

both aggregated and non-aggregatedclaims data in order to conductevaluations of the Part D program thatare unrelated to payment and thereforenot authorized under section 1860D15of the Act. In addition, agencies in thelegislative branch, such as the GAO,MedPAC, and CBO, may need access todata in order to evaluate the program.We continue to believe this.

We also continue to believe that otheragencies within DHHS, such as theCenters for Disease Control andPrevention, the Health Resources and

Services Administration, or the Office ofthe Assistant Secretary for Planning andEvaluation, may also need Part D claimsdata to perform evaluations or assesspolicies. However, we note specificallythat OIG has independent authority tocollect Part D claims data from Part Dsponsors to perform its statutory dutiesin accordance with the InspectorGeneral Act of 1978, as amended, 5U.S.C. App. This final rule provides OIGan additional avenue for access to thesedata for both payment and nonpaymentpurposes.

Given these necessities, we proposedto allow broad access for other Federalgovernment executive branch agenciesto our Part D claims data, linked to ourother claims data files. As stated in thepreamble of the proposed rule, otheragencies generally would enter into adata sharing agreement, similar to whatis used today. This would allow thesharing of event level cost data, protectthe confidentiality of beneficiaryinformation, and ensure that the use ofPart D claims data serves a legitimatepurpose. We also stated in the proposedrule that we would also ensure that any
http://www.cms.hhs.gov/Pharmacy/07http://www.cms.hhs.gov/Pharmacy/07


10/23



system of records with respect to Part Dclaims data is updated to reflect themost current uses of such data.

In the proposed rule, we requestedcomments that would help us in ourefforts to improve knowledge relevant tothe public health. Specifically, werequested guidance on how we can bestserve the needs of other agencies

through the sharing of information wecollect under section 1860D12(b)(3)(D)of the Act, while at the same timeaddressing the legitimate concerns ofthe public and of Part D plan sponsorsthat we appropriately guard against thepotential misuse of data in ways thatwould undermine protections put inplace to ensure confidentiality of

beneficiary information, and thenondisclosure of proprietary datasubmitted by Part D plans.

After considering the commentsreceived, we will make Part D claimsdata available under a process that

builds upon the practice that iscurrently in place today with respect tothe release of Medicare Parts A and Bdata. Thus, we specify in this final rulethat, of the data we collect under theauthority of section 1860D12 of theAct, only the minimum informationnecessary, subject, in certain cases, toencryption and aggregation of certainelements, will be shared with otherFederal executive branch agencies,which would include contractors actingon their behalf, in accordance withsection 1106 of the Act, based on datasharing procedures established by CMS

and agreed to by the Federal executivebranch agency requesting the data. Theattached appendix, as well as ouramended rules at 423.505(m), explainhow in this final rule we would groupthe governmental entities outside ofCMS that request access to the datacollected under 1860D12 of the Act.Agencies within HHS, as well as theCongressional oversight agencies(including CRS when acting on behalf ofa committee) would receive only theelements of the PDEs on the claim thatare minimally necessary for theapplicable project. Plan, pharmacy, andprescriber identifiers would beencrypted unless necessary for theproject. In addition, for States and non-HHS executive branches, the dispensingfee, ingredient cost and sales taxelements on the claim would beaggregated together prior to any release,except that, upon request, we willexclude sales tax from the aggregation atthe individual claim level if necessary.

Comment:One commenter objected tothe use of the word necessities,stating that it is not necessary to allow

broad access to Part D claims data.

Response:We continue to believe thatit is both necessary and appropriate forthe Secretary to collect the Part D claimsdata under section 1860D12(b)(3)(D) ofthe Act in order to carry out his broadrange of duties under the Act, includingthe duties that are listed at 423.505(f)(3). Once the Secretarycollects the information for his own

necessary and appropriate purposes, wedo not believe that the external releaseof such information must be categorizedas necessary in order for it to occur, assection 1860D12(b)(3)(D) of the Actrefers to the collection of, not the releaseof, data. Release of data will beauthorized under section 1106 of theAct. In addition, any release will beintended for the benefit of the publichealth and welfare.

Comment:Several commentersrequested that the FDA play a centralrole in any use of Part D claims data forsafety evaluations. Others requested that

CMS issue a separate proposal topresent CMS and FDA combined viewson sharing of data for public comment.One commenter also contended that theFDA may not want to use Part D claimsdata because of alleged reliabilityproblems and the fact that the FDA mayhave problems integrating the Part Dclaims data with its own databases.Finally, commenters requested that bothagencies allow manufacturers to reviewthe data and methods used for post-marketing surveillance.

Response:We do not believe that theFDAs use of Part D claims data or howthe claims data are used in safety

evaluations is the subject of thisproposed rule. However, we note thatwe plan to exchange Part D claims datawith the FDA in accordance withapplicable laws and our data sharingprocedures, by entering into appropriateinteragency agreements and data useagreements. Thus, our procedures forsharing data with the FDA will be thesame as those developed for othergovernment agencies.

Comment:A commenter requestedthat the Congressional Research Service(CRS) be able to access the same levelof data as oversight agencies, such as the

Office of the Inspector General (OIG),the Government Accountability Office(GAO), the Congressional Budget Office(CBO), and the Medicare PaymentAdvisory Commission (MedPAC).

Response:In the proposed rule westated that the Congressional oversightagencies (GAO, MedPAC, and CBO) mayrequire access to data in order toevaluate the Part D program (71 FR61452). Although we did not define CRSas a Congressional Oversight entity, likeGAO, it does have statutory authority torequest data (see 2 U.S.C. 166(d)(1)), but

only when it is doing so on behalf of acommittee. Accordingly, we arespecifying that CRS will be considereda congressional oversight agency whenthe CRS is acting on behalf of committeeunder 2 U.S.C. 166(d)(1). Ourregulations at 423.505(m), as well asthe attached appendix outline the datapolicies that would apply to

congressional oversight agencies,including being subject to our minimumdata necessary policy, our data sharingprocedures, and applicable laws. Forindividually identifiable information orcertain commercially or financiallysensitive information, such as planidentifiers and cost information, theseCongressional oversight agencies will berequired to sign a Data Use Agreement(or provide assurances acceptable toCMS) to protect against disclosure ofsuch data. When CRS is not acting asthe agent of a committee, however, itdoes not have the same authority to

request data from departments oragencies of the United States. Thus, wehave specified that in these cases, CRSwould be treated as an external entity,

because the agency would essentially beperforming research or analysis on

behalf of an individual member of thecongress. In addition, unlike States orother executive branch departments, theCRS should not need access to planidentifiers or other data on the claim inorder to coordinate care on behalf of

beneficiaries. Thus, we have specifiedthat CRS will be restricted in the samemanner as external researchers, and willnot be treated similar to other executive

branch agencies or States.Comment:A commenter asked CMS

to allow for a process that permitsaccess to Part D claims data in a highlyorganized way and enables externalentities to replicate any results Federalagencies obtain using the data.

Response:We believe that ourapproach to providing access to Part Dclaims data, which would follow areview of each request under ourminimum necessary data policy withsome additional encryption andaggregation restrictions based on type ofrequestor, balances the need for Part D

data in order to conduct legitimateresearch with the needs to protectpatient information and to preserve thecompetitive nature of the Part Dprogram. Therefore, we will reviewlegitimate research requests and decidewhether to release Part D claimsinformation, consistent with ourregulation at 423.505(m), as well as theguidance provided in the appendix tothis final rule. We expect that externalentities may be able to replicate theresults of Federal analyses for manyresearch questions, such as those


11/23



relating to the utilization of specificdrugs or classes of medications,comparative effectiveness or safetyresearch.

Comment:A few commenters askedthat all applicable government agencieshave broad access to the data in a timelyfashion without having to enter intonumerous data use agreements (DUA).

Response:As illustrated in ourregulation 423.505(m), as well as inthe appendix to this final rule, nonDHHS entities will have access to theminimum Part D claims data necessaryfor a given project, except that certainelements may be encrypted oraggregated. In the event of a backlog ofrequests for Part D data under theserules, we plan to give governmentagencies first preference in the reviewprocess, and to require such agencies toabide by our data sharing policies,which generally require a data useagreement. We have modified orstreamlined the data sharing process inthe case of certain Federal lawenforcement or oversight entities. Forexample, we have streamlined the DUAprocess for the Department of Justice(DOJ). DOJ provides a letter for eachrequest for data, which CMS tracks andmonitors.

2. External Entities

As stated in the preamble of theproposed rule, external entities, such asresearchers based in universities,regularly request and analyze Medicaredata for their research studies, many ofwhich are designed to address questions

of clinical importance and policyrelevance. We continue to believeresearchers studying a broad range oftopics need access to Part D claimslinked to Parts A and B claims data. Asstated in the preamble of the proposedrule, analyses of Parts A and B claimshave contributed to significantimprovements in the public health, have

been critical in assessing the quality andcosts of care for patients in the Medicareprogram, and have, in many cases,spurred other types of research. Assuch, we continue to believe that a datasource that includes Parts A and B

claims as well as their attendant Part Dclaims could be used in a similarlyconstructive manner, such that greaterknowledge on a range of topics, bothclinical and economic, would begenerated. This knowledge is expectedto contribute positively to theevaluation and functioning of theMedicare program, and to improve theclinical care of beneficiaries.

Also, as stated in the preamble of theproposed rule, we will specificallyaddress the needs of a segment ofexternal entities as part of our

implementation of section 723 of theMMA, which requires the Secretary todevelop a plan to improve the qualityof care and reduce the cost of care forchronically ill Medicare beneficiaries.The Congress specifically stated that theplan should provide for the collection ofdata in a data warehouse (under section723(b)(3) of the MMA). Within the

parameters of this regulation, we willimplement section 723 of the MMA bypopulating a chronic care condition datawarehouse (CCW) which will beaccessible by private researchers inorder for such researchers to conductstudies related to improving quality andreducing costs of care for chronically illMedicare beneficiaries.

In addition to the section 723 of theMMA data warehouse, we stated in theproposed rule that we are planning tomake Medicare Part D claims datalinked to other Medicare claims filesavailable to external entities on the

same terms as other Medicare Parts Aand B data are released today, withappropriate protections for beneficiaryconfidentiality. We requested commentson the proposed use of the data forresearch purposes that would help us inour efforts to improve knowledgerelevant to the publics health, as wellas comments on whether we shouldconsider additional regulatorylimitations for external entities beyondour existing data use agreementprotocols in order to further guardagainst the potential misuse of data fornon-research purposes, commercialpurposes, or to ensure that proprietary

plan data or confidential beneficiarydata are not released.

As explained in response tocomments, we continue to maintain thediscretion to release the 37 collectedPDE elements for legitimate researchpurposes, subject to encryption ofcertain identifiers and aggregation ofcost data to protect beneficiaryconfidentiality and commerciallysensitive data of Part D sponsors. (Theserestrictions are outlined in ourregulations at 423.505(m) as well as inthe appendix attached to this rule.)Furthermore, we also believe Part D

claims data are necessary for use inpersonal health records and to ensurethe public will be able to access theresults of quality measurement andperformance initiatives as discussed inthe Purpose of CMS CollectingInformation section of this preamble.We will release only the minimuminformation necessary for a givenproject. In addition, data will bedisseminated in accordance withapplicable laws via our established datasharing procedures. Thus, the requestorof data must agree to abide by the

restrictions established by our datasharing procedures in order to receiveaccess to Part D claims data. We willensure that our system of records forPart D claims data would permit theuses of the data described in this finalrule.

Comment:In general, the importanceof Part D claims data for improving

aspects of public health was a recurringtheme among many of the comments wereceived. Commenters noted the lack ofa comprehensive source of prescriptionmedication data as one of the greatestchallenges to conducting meaningfulresearch in the elderly. They noted thatPart D claims data will be vital forenhancing disease surveillance,identifying rare complications of drugtherapy, and improving knowledgeabout the effectiveness and safety ofdrugs. Several commenters underscoredthat knowledge based on selectedaspects of pharmacotherapy in the

elderly or disabled population islimited. They point out that the veryold, patients with multiple chronicconditions, and those taking multiplemedications are routinely excludedfrom clinical trials, and assert thatresearch based on Part D claims datawould provide a valuable supplement tothe FDAs current post-marketingsurveillance system.

Other themes raised by commenterscentered on the current fragmentation ofour health care information and the lackof information on drug treatment in theelderly. These commenters suggestedthat analyses of Part D claims data

linked with Parts A and B data couldprovide a comprehensive picture ofdisease treatment, help guard againstsiloed policy analyses, and support a

broad, disease-centered research agendathat would advance the essential qualityimprovement goals highlighted by theInstitute of Medicine in its report,Crossing the Quality Chasm: A NewHealth System for the 20th Century.Commenters also said analyses of Part Dclaims data would be beneficial fordeveloping comprehensive estimates ofthe costs of care, revealing the most costeffective disease therapies, and

understanding beneficiaries sensitivityto changes in cost sharing for drugs.Response:We agree with the many

comments that Part D claims data willbe essential for research analysesinvolving the elderly and disabled, andfor other public health functions.

Comment:Two commenters suggestedthat CMS implement a tiered system ofaccess to Part D claims data.Specifically, they suggested we establishseparate tiers for accessing the data,taking into account the need for dataand the opportunity for abuse, which


12/23



would correlate to the following groups:(1) Government agencies; (2) contractorsand researchers under contract withCMS or another government agency; and(3) outside researchers. They suggestthat Part D claims data be available tothe above-listed entities withinappropriate parameters, but not beavailable to entities, such as

pharmaceutical manufacturers andothers with strong proprietary interests.

Response:We considered severalalternatives to the Medicare A/B datarelease process including restricting:

Access to HHS agencies only, Access to Federal Government

agencies only, Access to financial elements for

outside researchers.We rejected these alternatives as too

restrictive in light of the significantbenefits to the Medicare program andthe publics health in making MedicareParts A, B, and D linked data available,with protections, to Federal and Stategovernment agencies, and externalentities. We believe that our approach,which incorporates the Medicare A/Bminimum necessary data policy withadditional restrictions to protect privacyand plan commercially sensitiveinformation, strikes an appropriate

balance between these significant healthbenefits and the concerns regarding therelease of proprietary data andpreserving beneficiary confidentiality.Moreover, we believe this process hassufficient protections to ensurecompliance with the applicable lawsand guard against the potential misuse

of data. External entities requestingaccess to Part D claims data will haveto enter into an agreement with us thatincludes provisions protecting the datafrom improper release.

Our regulation at 423.505(m), aswell as the attached appendix providesadditional guidance on the additionallimitations that would apply to externalentities (which would include CRSwhen not acting on behalf of acommittee as an agent, but would notinclude States or other executive-branchFederal agencies) requesting Part D data.Cost data (consisting of ingredient cost,

dispensing fee, and sales tax) could bereleased only in aggregated form. Inaddition, plan and other identifiersgenerally would be encrypted.

We also intend to only release theminimum data necessary for a givenproject. Additionally, we also note thatif an entity involved in a data release ofelectronic protected health information(EPHI) is a HIPAA-covered entity, thecovered entity will have to comply withour HIPAA privacy and securitystandards. In addition, the coveredentity should also follow the security

guidance which was released inDecember 2006. The guidance reinforcesour existing security standards tospecifically address remote access anduse of EPHI. This reinforcement of theHIPAA security standards, particularlyrelated to data in transit, will furtherprotect Part D claims data frominappropriate release, and therefore

inappropriate use. For more informationon this guidance, please log on to http://www.cms.hhs.gov/SecurityStandard/.

Comment:We requested comments onwhether we should consider additionalregulatory limitations for externalresearchers beyond our existing data useagreement protocols in order to furtherguard against the potential misuse ofdata for non-research purposes,commercial purposes, or to ensure thatproprietary plan data or confidential

beneficiary data are not released. Inresponse, a number of commentersrequested that CMS define the term

commercial purposes clearly andnarrowly so that a broader range ofentities would have access to the data,including pharmaceuticalmanufacturers, insurance companies,and pharmacy benefit managers. Thesecommenters argue that instead ofprecluding certain types of entities fromaccessing Part D claims data, it would

be better to focus on assuring researcherquality and integrity, and on ensuringthat researchers adopt soundmethodologies in conducting analyses.Therefore, the commenters request thatthe clear bias against pharmaceuticalcompany supported research be

removed from the CMS review criteria.As noted previously, other

commenters suggested that the finalregulation should deny access to data toorganizations with strong proprietaryinterests, such as drug plan sponsors,pharmaceutical manufacturers, andother industry data collection entitiesthat sell market research and sales data.

Response:Under our current policiesfor Parts A and B data, we do notprovide protected health information(PHI), as defined for purposes of HIPAAat 45 CFR 160.103, for commercialpurposes, as we believe PHI should only

be provided to entities conductingresearch that will result in generalizableknowledge in the public domain. We areconcerned about the potential forconflicts of interest where commercialentities, whose primary purpose is notthe creation of generalizable knowledge,might not publish results contrary to thefirms financial interest. However, wedo allow external researchers to befunded by commercial firms, includingpharmaceutical manufacturers,insurance companies, and pharmacy

benefit managers when the research will

contribute to general knowledge in thepublic domain and the researchers arefree to publish the results of theresearch regardless of the findings. Wecontinue to believe that any findings

based on beneficiary identifiable datareleased by us should be unbiased bycommercial incentives and should be inthe public domain. The criteria

governing releases of protected healthinformation (PHI) for research aredesigned to ensure that the HIPAAPrivacy Rules requirements, as definedat 45 CFR 164.512(i), as well as our ownpolicies are met. In this final rule, weuse the definition of research containedin the HIPAA Privacy Rule, whichdefines the term as a systematicinvestigation, including researchdevelopment, testing and evaluation,designed to develop or contribute togeneralizable knowledge (45 CFR164.501). Thus, we do not release PHIto external entities when their research

is not designed to develop or contributeto the generalizable knowledge. Nor dowe release PHI to external entities fortheir commercial purposes or if they failto demonstrate that they have a soundresearch methodology and that theirresearch will produce findings relevantto the Medicare program and its

beneficiaries.Therefore, we will continue to apply

the same criteria in distinguishingbetween who may have access to data(researchers versus commercialinterests), as we have been using forParts A and B data. Because we intendto examine whether each proposed use

of data meets the definition of researchused under the HIPAA Privacy Rule, wewill not be defining the termcommercial purposes in thisregulation.

Comment:We received severalcomments relating to the Freedom ofInformation Act (FOIA), noting thatreleases under FOIA should not includeinformation that would be consideredproprietary in nature.

Response:If a FOIA request isreceived, we will follow our ordinaryFOIA procedures and not release underFOIA data the agency determines are

trade secrets, or commercial or financialinformation protected by FOIAExemption 4 (5 U.S.C. 552(b)(4)). Theseprocedures were explained more fullyin the preamble to the Part D final rule,where, in response to a question aboutprotecting bid information under FOIAwe stated:

[B]idders can always seek to protect theirinformation under the Freedom ofInformation Act and label truly proprietaryinformation confidential or proprietary.When information is so labeled, the bidder isrequired to explain the applicability of the
http://www.cms.hhs.gov/SecurityStandardhttp://www.cms.hhs.gov/SecurityStandard


13/23



FOIA exemption they are claiming. Whenthere is a request for information that isdesignated by the submitter as confidential orthat could reasonably be considered exemptunder Exemption 4, the Department isrequired by its FOIA regulation at 45 CFR 5.65(d) and by Executive Order 12,600 togive the submitter notice before theinformation is disclosed. To determinewhether the submitters information is

protected by Exemption 4, the submittermust show that (1) disclosure of theinformation is likely to impair thegovernments ability to obtain necessaryinformation in the future; (2) disclosure ofthe information is likely to cause substantialharm to the competitive position of thesubmitter; or (3) the records are consideredvaluable commodities in the marketplacewhich, once released through the FOIA,would result in a substantial loss of theirmarket value. Consistent with our approachunder the Part C program, we would notrelease information under the Part D programthat would be considered proprietary innature or that would tend to stifle theavailability of discounts or rebates from

pharmaceutical manufacturers negotiated byPart D plans.Bidders may identify trade secrets and

confidential business information (CBI) withtheir submission. However, if they have notwe will give them another chance when aFOIA request has been made on their records.In this case we will notify the businesssubmitters that we are in receipt of FOIArequests for their records. We will thenprovide the business submitters withinstructions and ask them to identify anytrade secret or CBI in order to justify ourapplication of Exemption 4. We will thenreview their justifications and highlightedinformation against FOIA case law to see ifwe can support their requested redactions.Under Executive Order 12600, if the businesssubmitters disagree with our Exemption 4analysis (which includes their justification)of their identified trade secret or CBI, theyare provided the opportunity to seek arestraining order or injunction in Federalcourt prohibiting us from releasing theirrecords under FOIA. (70 FR 4294 through4295)

Thus, for example, we do not expectthat any pricing data included on theclaim that fits within FOIA Exemption4 would be required to be releasedunder FOIA.

We also note that we do not view datareleases made under the authority of the

new 423.505(m) as FOIA releases.Unlike FOIA releases, these releases arenot required by law. Section 423.505(m)permits the release of data, but does notrequire it.

Comment:A number of commentersunderscored the importance of CMSmaking patient identifiers available inorder to achieve the full potential of PartD data. One commenter statedprescription drug claims files bythemselves lack the diagnostic,outcomes and other information tosupport the needed studies. However,

when merged with other data, they canbecome a powerful tool for improvingthe public health. Reflecting the viewsof several other commenters, thecommenter noted that Part D claimsdata could be linked to several otherdata sets such as: death and birthcertificate files; nursing homesMinimum Data Set; home health care

Outcome and Assessment InformationSet files; disease registries such as theSurveillance, Epidemiology, and EndResults-Medicare dataset developed bythe National Cancer Institute to studyoutcomes of cancer therapies;geographical data on characteristics andhealth care resources of communities;information on characteristics ofproviders (for example, use of primarymedical care versus specialty care); andMedicaid data on health care encountersand services not covered by Medicare.The commenter emphasized that linkingPart D data to the above information is

essential in order to provide accurateaccounting for outcomes and to bestaddress the many scientific pitfalls andpotential threats to validity that emergewhen one moves from experimental toobservational studies, such asunobserved variable bias andconfounding by indication or counter-indication.

Another commenter stated thatlinkage of the Part D data to population-

based surveys would provide invaluablesources for epidemiologic, healthservices and policy analyses and enableinvestigations into prevalence ofdiseases, their risk factors, progression,

and trends in treatment and drug use.Response:We agree these data are

more powerful when linked with otherdata sets. Linkage to Medicare Parts Aand B data is essential forunderstanding the impact of the Part D

benefit on use of other Medicareservices. There are a host of other typesof researc