Disclosure of QIO Information for Research Purposes -- Quality

10070 - Disclosure of QIO Information for Research Purposes -- Quality Review Study (QRS) Information (Rev. 15, Issued: 06-30-06; Effective/Implementation Dates: 06-30-06) A. Independent Research Activities You cannot disclose information that explicitly identifies institutions, practitioners, or your reviewers without their consent. You may disclose non-QRS information after deleting all confidential identifiers and any other information from which identification of an individual can be deduced. You must release de-identified information derived from information gathered as part of a QRS to individuals or organizations that request this information. De-identified means that all explicit and implicit identifiers of patients, practitioners, and providers (which include health plans) have been removed, encrypted, or otherwise modified to ensure that the identity of individuals or institutions may not be determined. Once the information has been de-identified, it becomes non-confidential and the requirements of 42 CFR 480.120(a)(8) and §10020 of the QIO Manual apply. Specifically, you must conform to the following conditions to have such information de- identified for release. When requesting de-identification of QRS information for release, you must: • Obtain prior approval from your Project Officer (PO). • Conclude a Data Use Agreement (DUA) with the researcher prior to de- identification (See Exhibit 10-1 - Model Data Use Agreement). When it is completed, your PO should receive a copy. • The DUA should specify both the length of time the researcher will need the data for the active analyses and, if applicable, the length of time you must retain the dataset following the active analyses (See below) (The intent of this requirement is to minimize the possibility that the researcher might mistakenly use the data for a purpose not covered by the Agreement). • Request that the Standard Data Processing System (SDPS) contractor prepare the de-identified dataset. You may not independently de-identify data. Procedures for requesting the SDPS contractor's assistance are outlined in SDPS Memorandum 01-232-GN. • At the request of the researcher and with the approval of your PO, request the SDPS contractor to link its data with other data provided by the researcher so long as all explicit and implicit identifiers are removed from the resulting dataset. OR • At the request of the researcher and with the approval of your PO, request the SDPS contractor to link its data with CMS data so long as all explicit and implicit identifiers are removed from the resulting dataset. For CMS datasets, the researcher does not have to provide an actual data file; however, the researcher must: - Submit a data request package to CMS Office of Information Services (OIS) for the CMS data that will be linked with the QIO data. The request package must include: a detailed request letter, project summary/protocol, proof of funding, and CMS DUA. If the project is Federally funded, it must also include a request/support letter from the Federal PO and the Federal PO must sign the CMS DUA. Additionally, provide OIS evidence of the approved QIO DUA. - Once the request has been reviewed and approved by OIS, OIS will notify the Office of Clinical Standards and Quality (OCSQ) of its approval. Once OIS approval for the use of the QIO data is confirmed, the SDPS contractor can perform the data pull and match. • At the request of the researcher, archive the dataset in the offline electronic medium provided by the SDPS contractor for up to 5 additional years following the completion of the active analyses. This retention period must be specified in the DUA. • If the user wishes to access the archived data for purposes of validating his conclusions, he must request a return of the dataset in writing. The request must specify the purpose for the request, the length of time needed for that purpose, and when the data will be returned. • In the event that your contract with CMS is terminated prior to the termination of either the active analysis period or the retention period specified in the DUA, provide full documentation to the new QIO, which will conclude a new DUA with the researcher. If a new agreement is not concluded, the user forfeits all rights and privileges specified in this agreement and must return the data immediately. • Maintain a record of all de-identified data provided and ensure that they are returned or destroyed as required in the DUA (The intent is to ensure that unneeded data are destroyed and not retained indefinitely). • Should the same researcher wish to use the dataset for another project or should another researcher request the same dataset from you, prior to its release, you must conclude another DUA and provide your PO with a copy of that agreement. • You may charge a fee for this service. This fee may not exceed the amount necessary to recover the cost to you and the SDPS contractor for providing the information (see 42 CFR 480.104(c)). This policy does not permit you to de-identify data provided by CMS for purposes of performing your contract (see Section H of your Contract). B. Use of CMS-provided Data and/or Statutory Authority to Obtain Medical Records You may not use information provided by CMS or information acquired through the statutory authority to obtain medical records granted by your Contract for any purpose other than one specifically authorized by that Contract. For example, you may not use Medicare Provider Analysis & Review (MedPAR) or enrollment data obtained from CMS to provide a random sample for a researcher, nor may you use your Contract authority to obtain medical records and related information for purposes other than those provided for in that Contract. If you request medical information in any capacity other than that of a QIO, as specified in your QIO contract with CMS, any request to a practitioner, provider, or beneficiary must clearly indicate that you are requesting the information outside your capacity as a QIO. In addition, include the following language within any such request: • "You are not required to provide the information requested in this letter. Neither your Medicare benefits nor your participation in the Medicare program will be affected should you decide not to participate." This language is not required when a researcher is your employee (either part or full- time) and the activities being carried out relate directly to a Quality Improvement Project that you are conducting and which is funded by your QIO Contract. C. Provider and/or Practitioner Ability to Designate an Agent to Receive Certain Information If a provider or practitioner, in writing, designates another party (e.g., corporate owner) as their agent for the receipt of specific data which they may obtain from you, you may, upon the written request of the provider(s) or practitioner(s), transmit the specified data to the agent either in lieu of or in addition to transmitting it to the provider(s) or practitioner(s). You must receive from the provider or practitioner both a designation of the agent and a request to send specific data to the agent. These items may be contained in the same written instrument (See Exhibit 10-2 - Model Letter). In addition, when the requested data is sent to the agent, the agent must be advised of important information about re-disclosing data received from a QIO or Network (See Exhibit 10-3 - Model Language). You should inform your CMS PO of such arrangements and maintain adequate documentation of the arrangement. You may charge the reasonable costs of the disclosure in accordance with the provisions of 42 CFR 480.104(c). D. DHHS Research Activities Research entities acting as employees or subcontractors of DHHS have access to your non-QRS confidential information when it is needed to accomplish DHHS' objectives. Provide this information in the manner and form required by DHHS in accordance with 42 CFR 480.130.