Data Release Review Board and Review Procedures

(1) Public Use Files. The Council shall create three public use files of the Health Care Claims Data, including the Member Eligibility (ME) data, Medical Claims (MC) data, and Pharmacy Claims (PC) data. (a) Level 1. The Level 1 file includes the following Data Elements: Data Element # Data Element Name Insurance Type Year of Reported Eligibility Month of Reported Eligibility Coverage Level Code Individual Relationship Code Member Gender Member State or Province Medical Coverage -Yes/No Prescription Drug Coverage -Yes/No Race 1 Race 2 Other Race Hispanic Indicator -Yes/No Ethnicity 1 Ethnicity 2 Other Ethnicity Insurance Type/Product Code Individual Relationship Code Member Gender Admission Hour Admission Type Admission Source Discharge Hour Discharge Status Length of Stay (LOS) Service Provider Entity Type Qualifier Service Provider Suffix Service Provider State MC035A Service Provider Country Name Type of Bill -on Facility Claims Site of Service -on NSF/CMS 1500 Claims Claim Status Admitting Diagnosis E-Code Principal Diagnosis Data Element # Data Element Name (continued) Revenue Code Procedure 1 Code Procedure 1 Modifier- 1 Procedure 1 Modifier -2 ICD-9-CM Procedure 1 Code Quantity Copay Amount Deductible Amount Insurance Type/Product Code Individual Relationship Code Member Gender Date Service Approved (AP Date) PC024A Pharmacy Country Name Claim Status Drug Code Drug Name New Prescription PC028A Refill Number Generic Drug Indicator Dispense as Written Code Compound Drug Indicator Quantity Dispensed Days Supply Average Wholesale Price (AWP) Postage Amount Claimed Dispensing Fee Copay Amount Deductible Amount (b) Level 2. The Level 2 file includes all the data elements in Level 1 plus the following data elements: Data Element # Data Element Name Payer National Plan ID Encrypted Subscriber Unique Identification Number Plan Specific Contract Number Member Suffice or Sequence Number Member Identification Code Member Age in Years Member Age in Months Member City Name Member ZIP Code 129 CMR-67 Data Element # Data Element Name (continued) Payer National Plan ID Payer Claim Control Number Line Counter MC005A Version Number Encrypted Subscriber Unique Identification Number Plan Specific Contract Number Member Suffix or Sequence Number Member Identification Code Member City Name Member State or Province Member ZIP Code Date Service Approved (AP Date) Admission Date MC022A Discharge Date Member Age in Years at Discharge Member Age in Months at Discharge Service Provider Number Service Provider Tax ID Number National Service Provider ID Service Provider First Name Service Provider Middle Name Service Provider Last Name or Organization Name Service Provider Specialty Service Provider City Name Service Provider ZIP Code Date of Service -From Date of Service -Thru Charge Amount Paid Amount Prepaid Amount Coinsurance Amount (c) Level 3. The Level 3 file includes all the data elements in Level 2 plus the following data elements: Data Element # Data Element Name Insured Group or Policy Number Member Date of Birth Insured Group or Policy Number Member Date of Birth Insured Group Number Member Date of Birth (2) Data Release Review Board. The Council shall designate a Data Release Review Board to review applications for Health Care Claims Data filed pursuant to M.G.L. c. 6A, § 16K. (a) Members. The Board shall include at least one member of the Councilor Council member's designee; one member of the Council's Advisory Committee (established pursuant to M.G.L. c. 6A, § 16L); an attorney with expertise in health data privacy issues; a data security expert; a representative of a hospital licensed in Massachusetts; a clinician licensed to practice in Massachusetts; and any other individual whom both the Councilor designated Council staff deem necessary for the review and evaluation of applications for Health Care Claims Data. The Board shall include at least one person who has expertise using statistics, clinical data, demographic data, and payment data. continued (b) Terms. Members of the Board shall be appointed to serve for two years, but may be removed by a vote of the majority of the Council. (c) Administration. Under the Board's direction and authority, Council staff shall: 1. develop standard application materials; 2. review all applications for Health Care Claims Data; 3. ensure that all applications for Health Care Claims Data are complete; 4. process and approve applications for Level 1 Data Elements that meet the requirements of 129 CMR 3.03 through 3.05 and that do not involve any Level 2 data elements; 5. refer to the Board for review all applications for Level 2 Data Elements and any other applications that the Administrative Director or Council staff deem appropriate for the Board's review; 6. reject all applications for Level 3 Data, except those applications received from state agencies pursuant to 129 CMR 3.03(4); 7. refer all applications for Level 3 Data received from state agencies to the Board for review and action by the Board; and 8. prepare materials for presentation to the Board. (d) Meetings. The Board shall meet regularly according to a schedule set by the Council to review applications for Level 2 and Level 3 Data Elements and to review applications for any other Health Care Claims Data that Council staff deems appropriate for the Board's review. (e) Criteria for Release of Data. The Board will review the proposed use of the data, the credentials of the applicant, and the nature of the data requested. The Board shall, at a minimum, consider the following factors: 1. whether the proposed use of the data will jeopardize patient privacy; 2. whether the proposed disclosure may enable collusion or anti-competitive conduct; 3. the effect of the proposed use on the quality and costs of health care; and 4. whether the proposed use will further the public interest by promoting improvements in health care quality or reductions in the growth of health care costs. (3) Application Review Procedures. (a) Applications for Data. All data applicants requesting access to, disclosure of, or use of Health Care Claims Data shall submit a written application using a form approved by the Council. In accordance with 129 CMR 3.03(3), only state agencies may apply for Level 3 Data. (b) Application Requirements. All applicants shall: 1. specify the purpose and intended use of the data requested, including a detailed project description; 2. specify each data field requested; 3. justify the need for each requested Level 2 Data Element to accomplish the applicant's stated purpose; 4. specify the applicant's qualifications to perform such research or accomplish the intended use; 5. specify administrative, security and privacy measures to be taken to safeguard the confidentiality of patient information, payment rates, and any Level 2 and Level 3 Data Elements that the Board permits to be released, and to prevent unauthorized access to or use of such data; 6. specify the applicant's methodology for maintaining data integrity and accuracy; 7. identify all employees who will have access to the requested Health Care Claims Data, and describe the activities they will conduct with the data and their qualifications to conduct those activities; 8. specify whether the applicant intends to engage an agent or contractor to conduct any function with the requested data and if so, identify such functions, describe the agent's or contractor's qualifications, state whether the agent or contractor will have access to the data at a location other than the applicant's location or in an off-site server and/or database, and specify all data security measures to be instituted with such agent or contractor; 9. specify measures the applicant, his/her employees, and his/her agents will take to return the original released data to the Council at the conclusion of the applicant's use and to destroy all copies of the data remaining in the applicant's, his/her employee's and his/her agent's possession or control; 10. specify research protocols, as applicable; 11. specify whether the data will be linked to or used in conjunction with other data sources and if so, identify such data sources and explain the purpose for such linking and whether such linking would enable re-identification of the requested data elements; 12. specify the applicant's plans to publish or otherwise disclose any Level 1, Level 2 and Level 3 Data Elements, or any data derived or extracted from such data, in any paper, report, website, statistical tabulation, or similar document; and 13. agree to pay the application fee or request a waiver of the fee. (c) Criteria for Approval. The Board may approve for release to an applicant only the requested Health Care Claims Data that the Board determines is necessary to accomplish the applicant's purpose and intended use. Factors the Board may consider in determining whether to exercise its discretion to approve an application for Health Care Claims Data include, but are not limited to, the following: 1. the purpose for which the data is requested is in the public interest and is consistent with the mission and goals of the Council. Uses that serve the Council's mission and the public interest include, but are not limited to: health cost, quality and utilization analyses to formulate public policy; financial studies and analysis of hospital payment systems; utilization review studies; studies to develop indicators of quality of care and to identify areas for improvement; health care facility merger analyses; health planning and resource allocation studies; epidemiological studies, including the identification of morbidity and mortality patterns, and studies of prevalence and incidence of diseases; and research studies and investigation of other health care issues; 2. the applicant has demonstrated it is qualified to undertake the study or accomplish the intended use; 3. the applicant requires such data in order to undertake the study or accomplish the intended use; 4. the applicant can ensure that patient privacy will be protected; 5. the applicant can ensure that the identities of clinicians will be kept confidential; 6. the applicant can ensure that individual payment rates will be kept confidential; 7. the applicant can safeguard against unauthorized use and disclosure; 8. the applicant signs a Data Use Agreement that sets forth its agreement to comply with data release restrictions, prohibitions, and protections for the Council's Data; and 9. the applicant requires that any staff or agent that will have access to or process the data on the applicant's behalf agrees to follow all data restrictions, prohibitions, and protections set forth in 129 CMR 3.00 and the Data Use Agreement. (4) Data Release Procedures. (a) The Council shall establish a regular schedule for submission of applications and for review by the Board. The schedule shall provide that the Board will make reasonable efforts to notify each applicant of the Board's decision within 45 days of the scheduled application submission date. (b) The Board shall authorize access to data containing the fewest number of Data Elements necessary to accomplish the applicant's purpose or intended use. Similarly, if the Board determines that not all of the elements the applicant has requested are consistent with the applicant's intended use and purpose or with the mission and goals of the Council, or that release of certain requested elements may jeopardize patient privacy , or may enable collusion or anti-competitive conduct or may involve a likelihood of increasing health care costs, the Board may authorize the release of only those Data Elements that the Board deems consistent with the applicant's purpose and intended use or the Council's mission and goals or the release of which will not jeopardize patient privacy, enable collusion or anti-competitive conduct, or involve a likelihood of increasing health care costs. (c) If the application is incomplete or if the Board determines that supplemental information is needed to make its decision, the Board may require such supplemental information and notify the applicant accordingly. The Board's request for supplemental information from the applicant will trigger a new 45-day notification period (as set forth 129 CMR 3.03(2)(a)): a new 45-day notification period will begin to run on the date the applicant must provide the supplemental information to the Board (the date to be determined by the Board) or the date the applicant in fact provides the supplemental information to the Board, whichever is later. (d) If the Board denies an application for data in whole or in part, the Board will notify the applicant of the reason for denial. (e) An applicant may resubmit his or her application to address the concerns raised by the Board in its decision. The Board may reconsider a determination made under 129 CMR 3.03 based on new information or any other reasonable cause. (f) An applicant may appeal the denial of any application for data release by the Board to the Council. Such appeal must be filed within 30 days of the Board's decision and must specify the reason(s) that the applicant considers the Board's decision to be in error. (4) Data Release to State Agencies. The Council may release to state agencies Level 1 and Level 2 data for uses that promote the public interest; and Level 3 data as authorized by M.G.L. c. 6A, § 16K. (a) Except as provided in 129 CMR 3.03(4)(e), a state agency must submit an application to the Data Release Review Board for data in compliance with the requirements of 129 CMR 3.02(b). (b) Each agency shall enter into an interagency service agreement with the Council that allows for specifically approved purposes and uses within the public interest, provides for security and measures to safeguard the confidentiality of patient information, fulfills the applicable requirements set forth in 129 CMR 3.03(2)(b) and (c), and makes the required assurances set forth in 129 CMR 3.04(1). (d) After an agency's initial request has been approved by the Board and an interagency service agreement has been executed, the Council may expedite subsequent data requests through a streamlined review process for additional agency projects or uses not stated in the original request. (e) The Council will provide state agencies with public use files free of charge. The Council may charge a state agency that requests custom programming of the Council's datasets the actual cost incurred to fulfill the request. The Council will notify the agency of the estimated cost prior to fulfilling the request. (f) Level 3 Data. 1. The Council may release Level 3 data to state agencies for purposes that promote the public interest as determined by the Council. 2. The Council shall provide the Division of Health Care Finance and Policy with the Level 3 Health Care Claims Data in accordance with the provisions of M.G.L. c. 6A, § 16K under an interagency service agreement for the purpose of conducting data analysis, preparing reports to assist in the formulation of health care policy and the provisions and purchase of health care services, and reviewing and evaluating mandated benefit proposals as required by M.G.L. c. 3, § 38C.