216-RICR-10-10-5
216-RICR-10-10-5. Rhode Island All-Payer Claims Database (version Adoption, 07/09/2013 to 08/21/2018)
RULES AND REGULATIONS PERTAINING TO THE RHODE
ISLAND ALL-PAYER CLAIMS DATABASE
[R23-17.17- RIAPCD]
STATE OF RHODE ISLAND AND PROVIDENCE PLANTATIONS
DEPARTMENT OF HEALTH
July 2013
i
INTRODUCTION
These Rules and Regulations Pertaining to the Rhode Island All-Payer Claims Database
[R23-17.17-RIAPCD] are promulgated pursuant to the authority conferred under Chapters 23-
17.17 and 42-35 of the General Laws of Rhode Island, as amended, and are established for the
purpose of adopting regulations designed to implement the provisions of Chapter 23-17.17 of the
Rhode Island General Laws, as amended, including the details and format for the Rhode Island
All-Payer Claims Database (RIAPCD).
Pursuant to the provisions of §§42-35-3(a)(3) and (a)(4) of the General Laws of Rhode
Island, as amended, the following were given consideration in arriving at these regulations: (1)
alternative approaches to the regulations; (2) duplication or overlap with other state regulations;
and (3) significant economic impact on small business. Based on the available information, no
known alternative approach, duplication or overlap was identified.
These Rules and Regulations Pertaining to the Rhode Island All-Payer Claims Database
establish a framework for the submission of health care claims data and related datasets for the
purpose of creating a health care quality and value database known as the Rhode Island All Payer
Claims Dataset (APCD), to meet and inform the following goals:
(1) Determine the capacity and distribution of existing resources;
(2) Identify health care needs and inform health care policy;
(3) Evaluate the effectiveness of intervention programs on improving patient outcomes;
(4) Compare costs between various treatment settings and approaches;
(5) Provide information to consumers and purchasers of health care;
(6) Improve the quality and affordability of patient health care and health care coverage;
(7) Strengthen primary care infrastructure;
(8) Strengthen chronic disease management;
(9) Encourage evidence-based practices in health care.
The purpose of the Rules and Regulations Pertaining to the Rhode Island All-Payer Claims
Database is:
(1) To define the reporting requirements for health plans and Insurers to submit data and
information to APCD for the purpose of developing and maintaining the All-Payer
Claims Dataset (APCD); and
(2) To define the parameters for release of data, including the administrative process for
release in a manner that maximizes public access while adhering to the highest standards
of data privacy and security as permitted by applicable state and federal law.
ii
TABLE OF CONTENTS
Page
PART I
Definitions, General Provisions and Confidentially
1
1.0
Definitions
1
2.0
General Provisions
4
3.0
Confidentiality
5
PART II Requirements for the Rhode Island All-Payer Claims Database
7
4.0
Submission Requirements
7
5.0
Technical Requirements
8
6.0
Compliance with Data Standards
10
7.0
Procedures for the Approval and Release of Claims Data
11
PART III Compliance, Variances, Practices and Procedures and Severability
16
8.0
Compliance and Enforcement
16
9.0
Variance Procedure
16
10.0
Rules Governing Practices and Procedures
16
11.0
Severability
16
APPENDICES
A1
Data Elements for Public Use and Restricted Release and Data to be
Submitted by Insurer - Member Eligibility File to Encrypted Unique
Identifier Vendor
A1-1
A2
Data Elements for Public Use and Restricted Release and Data to be
Submitted by Insurer - Member Eligibility File to Data Aggregator
A2-1
B
Medical Claims Data File
B-1
Provider File
B-4
Pharmacy File
B-5
1
PART I
Definitions, General Provisions and Confidentially
Section 1.0
Definitions
Wherever used in these Regulations, the following terms shall be construed as follows:
1.1
“Analytic file” means the set of files that is created from RIAPCD submissions. Analytic
Files may include information created through the application of analytic tools or derived
from other data sources.
1.2
“Applicant” means an individual or organization that requests health care data and
information in accordance with the procedures and requirements instituted by the
Department pursuant to these regulations.
1.3
“Data aggregator” means a vendor selected by the Director that has a contract to act on
behalf of the Department to collect and process health care claims data on behalf of the
Director.
1.4
“De-identified health information” means information that does not identify an
individual provider, patient, member or enrollee. De-identification means that such health
information shall not be individually identifiable and shall require the removal of direct
personal identifiers associated with patients, members or enrollees.
1.5
“Department” means the Rhode Island Department of Health.
1.6
“Director” means the Director of the Department of Health or his or her duly authorized
designee.
1.7
“Direct Personal Identifier” means any information, as to a member, other than case or
code numbers used to create anonymous or encrypted data, that plainly discloses the
identity of an individual, including:
(a) Names;
(b) Business names when that name would serve to identify a person;
(c) Elements of patient birth dates, except for year of birth or year of birth within an age
band;
(d) Postal address information other than town or city, state and 5-digit ZIP code;
(e) Specific latitude and longitude or other geographic information that would be used to
derive postal address;
(f) Telephone and fax numbers;
(g) Electronic mail addresses;
(h) Social Security numbers;
(i) Vehicle identifiers and serial numbers, including license plate numbers;
(j) Medical record numbers;
(k) Health plan beneficiary numbers;
(l) Patient account numbers;
(m) Personal Internet protocol (IP) addresses and uniform resource locators (URL),
including those that identify a business that would serve to identify a person;
(n) Biometric identifiers, including finger and voice prints; and
2
(o) Personal photographic images;
(p) Any other unique patient identifying number, characteristic, but not including the
Encrypted Unique Identifier.
1.8
“Disclosure” means the release, transfer, provision of access to, or divulging in any other
manner of information outside the entity holding the information.
1.9
“Encrypted unique identifier” means a code or other means of record identification to
allow each patient, member or enrollee to be tracked across the data set, including across
payers and over time, without revealing direct personal identifiers. Encrypted unique
identifiers are assigned to each patient, member or enrollee in order that all direct
personal identifiers can be removed from the data when data is submitted. Using the
encrypted unique identifier, all records relating to a patient, member or enrollee can be
linked for analytical, public reporting and research purposes without identifying the
patient, member or enrollee.
1.10
“Encrypted unique identifier vendor” means a vendor selected and approved by the
Director to collect demographic data only from Insurers, assign an encrypted unique
identifier to each patient, member, or enrollee, and transmit that identifier to the Insurer.
1.11
“Encryption” means a method by which the true value of data has been disguised in
order to prevent the identification of persons or groups, and which does not provide the
means for recovering the true value of the data.
1.12
“Hashing” means a one-way method by which the true value of data has been
transformed (through the conversion of the information into an unrecognizable string of
characters) in order to prevent the identification of persons or groups. True value of
hashed elements is deliberately non-recoverable by any recipient, including the Data
Aggregator.
1.13
“Health benefit plan” means a policy, contract, certificate or agreement entered into, or
offered by an Insurer to provide, deliver, arrange for, pay for or reimburse any of the
costs of health care services.
1.14
“Health care data set” means a collection of individual data files, including medical
claims files, pharmacy claims files, member eligibility files and provider files, whether in
electronic or manual form.
1.15
“Health care facility” shall have the same meaning as contained in RIGL Chapter 23-17
and the regulations promulgated pursuant to that Chapter.
1.16
“Health care provider” means any person or entity licensed to provide or lawfully
providing health care services, including, but not limited to, a physician, hospital,
intermediate care facility or other health care facility, dentist, nurse, optometrist,
podiatrist, physical therapist, psychiatric social worker, pharmacist or psychologist, and
any officer, employee, or agent of that provider acting in the course and scope of his or
her employment or agency related to or supportive of health care services.
1.17
“HIPAA” means the Health Insurance Portability and Accountability Act of 1996, as
amended, and it’s implementing regulations (45 CFR Parts 160-164).
3
1.18
“Insurer” means any entity subject to the insurance laws and regulations of Rhode
Island, that contracts or offers to contract to provide, deliver, arrange for, pay for, or
reimburse any of the costs of health care services, including, without limitation, an
insurance company offering accident and sickness insurance, a health maintenance
organization, as defined by RIGL §27-41-1, a nonprofit hospital or medical service
corporation, as defined by RIGL §§ 27-19 and 27-20, or any other entity providing a plan
of health insurance or health benefits. For the purpose of these Regulations, a third-party
payer, third-party administrator, or Medicare or Medicaid health plan sponsor is also
deemed to be an Insurer.
1.19
“Medical claims file” means all submitted and non-denied adjudicated claims for each
billed service paid by an Insurer as defined in §1.18 on behalf of a Member as defined in
§1.20 regardless of where the service was provided. This data file includes but is not
limited to service level remittance information including, but not limited to, member
encrypted unique identifier, provider information, charge/payment information, and
clinical diagnosis/procedure codes as will be described further in the RIAPCD Technical
Specification Manual.
1.20
“Member” means a Rhode Island resident who is a subscriber and any spouse or
dependent who is covered by the subscriber’s policy under contract with an Insurer. The
term also includes members of a small employer health insurance plan as defined by
RIGL §27-50-3 regardless of the state of residency of the member.
1.21
“Member eligibility file” means a data file composed of demographic information for
each individual member eligible for medical or pharmacy benefits as specified in the
RIAPCD Technical Specification Manual, for one or more days of coverage at any time
during the reporting month.
1.22
“Patient” means any person in the data set that is the subject of the activities of the claim
submitted to and/or paid by the Insurer or covered by the health benefits plan.
1.23
“Personally identifiable information” means information, as to a member, relating to an
individual that contains direct personal identifiers.
1.24
“Pharmacy benefits manager” or “PBM” means any person or entity that develops or
manages pharmacy benefits, pharmacy network contracts, or the pharmacy benefit bid
process pursuant to a contract held with an Insurer for the provision of such services.
1.25
“Pharmacy claims file” means a data file composed of service-level remittance
information including, but not limited to, member demographics, provider information,
charge/payment information, and national drug codes from all submitted and non-denied
adjudicated claims for each prescription filled.
1.26
“Public use files” means the analytic files derived from records submitted by Insurers
that contain only data elements that have been determined by the Department to be public
use data elements listed in Appendix A-2 of these Regulations.
1.27
“Restricted release files” means the analytic files derived from records submitted by
Insurers that contain data elements that have been determined by the Department to be
restricted release data elements listed in Appendix A-2 of these Regulations.
4
1.28
“Rhode Island All-Payer Claims Database” or “RIAPCD” means a health care quality
and value database for the collection, management and reporting of eligibility, claims and
provider data submitted pursuant to RIGL Chapter 23-17.17.
1.29
“RIAPCD Technical Specification Manual” means the document issued by the
Department, or its contracted agent, that sets forth the required data file format, record
specifications, data elements, definitions, code tables and edit specifications.
1.30
“RIGL” means the General Laws of Rhode Island, as amended.
1.31
“Subscriber” means the individual responsible for payment of premiums to an Insurer or
whose employment is the basis for eligibility for membership in a health benefit plan.
1.32
“These Regulations” means all parts of the Rules and Regulations Pertaining to the
Rhode Island All-Payer Claims Database [R23-17.17-RIAPCD].
1.33
“Third-party administrator” or “TPA” means any person with a certificate of authority,
issued pursuant to RIGL § 27-20.7-12, who directly or indirectly solicits or effects
coverage of, underwrites, collects charges or premiums from, or adjusts or settles claims
on members, pursuant to RIGL § 27-20.7-2(1).
1.34
“Third-party payer” means a state agency that pays for health care services, or an
Insurer, carrier, including a carrier that provides only administrative services for plan
sponsors, nonprofit hospital, medical services organization, or managed care organization
licensed in Rhode Island.
Section 2.0
General Provisions
2.1
Purpose. These Regulations establish a framework for the submission of health care
claims data and related datasets for the purpose of developing and maintaining a health
care quality and value database known as the Rhode Island All-Payer Claims Database
(RIAPCD).
2.2
Applicability. Unless specifically exempted pursuant to §2.3, these Regulations apply to
all Insurers, as defined in §1.18 of these Regulations.
2.3
Exemptions. The requirements of these Regulations shall not apply to:
(a) An Insurer that on January 1 of a reporting year with less than three thousand (3,000)
enrolled or covered members; or
(b) Insurance coverage providing benefits for:
(1) Hospital confinement indemnity;
(2) Disability income;
(3) Accident only;
(4) Long-term care;
(5) Medicare supplement;
(6) Limited benefit health insurance as defined by RIGL §27-50-3(x);
5
(7) Specified disease indemnity;
(8) Sickness or bodily injury or death by accident or both; or
(9) Other limited benefit policies, including but not limited to those exempt from the
application of RIGL § 27-50-3 pursuant to subsection (t)(2)-(4) of that statute.
2.4
Optional Consent
(a) A covered insurer must permit enrolled or covered members to “opt out” of having
any information or health care claims relating to them submitted to the RIAPCD.
(1) Each covered Insurer shall develop an “Opt out” process independently to create a
system that works most efficiently for that entity.
Section 3.0
Confidentiality
3.1
Access to RIAPCD Information. Health care data sets and any other information
submitted pursuant to these Regulations, by and between Insurers, the Rhode Island All-
Payer Claims Database (RIAPCD), the Data Aggregator, and the Encrypted Unique
Identifier Vendor:
(a) Shall not be a public record as defined pursuant to RIGL § 38-2-2. No disclosure of
any RIAPCD data set(s) or health information shall be made unless specifically
authorized by the Director pursuant to these Regulations and as otherwise may be
prescribed by law or regulation.
(b) Shall be transmitted in accordance with the rules adopted in HIPAA (45 CFR Parts
160-164), Confidentiality of Health Care Communications and Information Act
(RIGL § 5-37.3) and other applicable law(s).
3.2
Removal of Personally Identifiable Information. All health care data sets submitted to
the Director or Data Aggregator pursuant to § 4.0 of these Regulations shall be protected
by the removal of all personally identifiable information and/or hashed. Under no
circumstances shall any Personal Health Information containing Personally Identifiable
Information be submitted to the Director or Data Aggregator.
3.3
Encrypted Unique Identifier. Insurers shall submit a member eligibility file, as
specified in Appendix A-1 of these Regulations, for each of its members to the encrypted
unique identifier vendor to effectuate this requirement in accordance with the timeline
outlined in § 5.2 of these Regulations. Under no circumstances shall the insurer submit
any Personal Health Information to the encrypted unique identifier vendor at any time or
for any reason. Only member demographic information, devoid of all Personal Health
Information of any kind, shall be submitted to the encrypted unique identifier vendor.
(a) Demographic data elements include but are not limited to: member name, date of
birth, Social Security number if available and date of enrollment.
(b) The encrypted unique identifier vendor shall assign each member an encrypted
unique identifier and transmit that information to the Insurer.
6
(c) The encrypted unique identifier vendor shall maintain records wholly separately from
the Director, the Department, the Data Aggregator and the All-Payer Claims Database
as defined by RIGL Chapter 23-17.17 and referenced by RIGL § 23-17.17-10(b).
(d) Notwithstanding any contractual arrangements, any member’s personally identifiable
information sent by an Insurer to the Encrypted Unique Identifier Vendor shall not be
shared with any other party including the Department, the Director, the Data
Aggregator or with the All-Payer Claims Database.
(e) Data which is required to be sent to the Encrypted Unique Identifier Vendor by the
Insurers shall not be considered data collected by the Department, the Director, the
Data Aggregator or the All-Payer Claims Database.
3.4
Transmission of Encrypted Unique Identifier to Insurers. The encrypted unique
identifier vendor shall provide the encrypted unique identifier assigned to a member to
the Insurer of record for that member. Prior to sending data sets to the Data Aggregator,
the Insurer shall attach the assigned encrypted unique identifier to each record. Prior to
transmitting the data sets and encrypted unique identifier to the Data Aggregator, all
direct personal identifiers shall be removed and/or hashed.
(a) The Insurer and/or payer shall maintain a record of the assignment of the encrypted
unique identifier assigned to each member in such a way that would permit an audit
or ongoing maintenance by the Director if necessary. Under no circumstance shall
such audit or ongoing maintenance allow the Department, the Director, the Data
Aggregator, or the RIAPCD to re-identify a Member.
(b) The Insurer and/or payer being audited may request that such audit include a third-
party review of the Unique Encrypted Identifier Vendor’s process for assignment and
transmission of the encrypted unique identifier assigned to each member of that
submitter. However, approval of a third-party review shall be at the sole discretion of
the Director.
7
PART II Requirements for the Rhode Island All-Payer Claims Database
Section 4.0
Submission Requirements
4.1
Specific Submission Requirements.
(a) Except as specifically exempted pursuant to § 2.3 of these Regulations, each Insurer
shall submit to the Director a health care data set including claims-line detail for all
health care services provided to a member, whether or not the health care was
provided within Rhode Island. Such data shall include, but shall not be limited to,
fully-insured and self-funded accounts, all commercial medical products for all
individuals and all group sizes and Medicare or Medicaid health plans. Under no
circumstances shall such data include personally identifiable information.
(1) Should the Insurer have insufficient information to populate a provider file in
compliance with § 4.3(b) of these Regulations for services provided to a Member
by an out-of-state, out-of network provider, the Insurer may omit the provider
file from an otherwise complete health care data file submission.
(2) Each Insurer shall also be responsible for the submission of all health care claims
processed by any sub-contractor on its behalf unless such sub-contractor is
already submitting the identical data as an Insurer in its own right.
(3) The health care data set submitted shall include, where applicable, a member
eligibility file, not including any personally identifiable information, but utilizing
the unique encrypted identifier assigned to the member, covering every member
enrolled during the reporting month whether or not the member utilized services
during the reporting period and a provider file, to be defined in the RIAPCD
Technical Specification Manual.
(4) The data submitted shall also include supporting definition files for payer
specific provider specialty taxonomy codes and procedure and/or diagnosis
codes.
(b) The health care data sets shall be submitted to the Data Aggregator in the format
required in the RIAPCD Technical Specification Manual.
(1) All health care data sets submitted to the Data Aggregator will have a Unique
Identifier attached and shall be protected by the removal of all personally
identifiable information and/or hashed.
(c) Insurers shall transmit the required health care data sets by means of a secure file
transfer system to the Data Aggregator in a manner that is fully compliant with
HIPAA and applicable Rhode Island statute and regulation.
4.2
RIAPCD Contact and Enrollment Update Form.
(a) Each Insurer shall submit to the Director or his or her designee by December 31st of
each year, in a format outlined in the RIAPCD Technical Specification Manual, a
contact and enrollment update form indicating if health care claims are being paid for
members and, if applicable, the types of coverage and estimated enrollment for the
following calendar year.
8
(b) It shall be the responsibility of the Insurer to resubmit or amend the form whenever
modifications occur relative to the health care data files, type(s) of business
conducted, or contact information.
4.3
Health Care Data Files to be Submitted
(a) Medical Claims File. Insurers shall submit data files consisted with the definition
contained in § 1.21 of these Regulations. As detailed in the RIAPCD Technical
Specification Manual, payers shall report information about services provided to
members under all reimbursement arrangements, including but not limited to fee for
service, capitated arrangements, and any other claims-based payment methods.
(b) Pharmacy Claims File. Insurers shall submit data files consistent with the definition
contained in §1.25 of these Regulations for all pharmacy paid claims for covered
pharmacy benefits that were actually dispensed to Members.
(c) Member Eligibility File. Insurers shall submit a data set that contains information on
every member enrolled during the reporting month whether or not the member
utilized services during the reporting period. Under no circumstances shall this data
submission include the member’s personally identifiable demographic information.
The submission will have a Unique Identifier attached and shall be protected by the
removal of all personally identifiable information and/or hashed.
(d) Provider File. Insurers shall submit a dataset that contains information that will
uniquely identify health care providers and allow retrieval of related information from
eligibility, medical and pharmacy claims files.
(1) Tax id numbers shall be submitted as part of the dataset except in the case that a
provider uses their personal social security number as their tax id number in
which case the tax id number need not be submitted.
4.4
Information Collected in Addition to the Health Care Data Set.
(a) The Director may require Insurers to submit and periodically update information
about the insurance product covering each member, including covered services,
market sector, plan characteristics, total premiums, deductibles, co-insurance and
copayments as set forth in the RIAPCD Technical Specification Manual.
(b) The Director may require Insurers to report information about payments received
under all reimbursement arrangements, including, but not limited to, fee-for-service,
capitated arrangements, pay-for-performance and any other payment methods.
Section 5.0
Technical Requirements
5.1
Code Sources and File Specifications. Only code sources and file specifications
specified in these Regulations and/or the RIAPCD Technical Specification Manual shall
be utilized in submission of the health care claims data sets required pursuant to § 4.0 of
these Regulations.
9
5.2
Schedule for Submissions. Insurers shall submit information to the RIAPCD and the
Encrypted Unique Identifier Vendor in the specified format in accordance with the
following schedule:
(a) Test Data Submissions
(1) Within one hundred twenty (120) days of the release of the final RIAPCD
Technical Specification Manual, Insurers shall submit test files containing a
month of representative member eligibility files as defined in Appendix A-1 of
these Regulations from January 2009 or as specified in the RIAPCD Technical
Specification Manual to the Encrypted Unique Identifier Vendor.
(2) The Encrypted Unique Identifier Vendor shall return the member eligibility file
to the Insurer with an assigned Encrypted Unique Identifier within fifteen (15)
days of a test file submission by an Insurer.
(3) Within one hundred and fifty (150) days of the release of the final RIAPCD
Technical Specification Manual, Insurers shall submit part one of their test files
containing a month of representative member eligibility files, provider
information, and medical and pharmacy claims paid as defined in Appendix A-2
of these Regulations during January 2009 or as specified in the RIAPCD
Technical Specification Manual to the Data Aggregator.
(b) Historical Data Submissions
(1) Within two hundred and seventy (270) days of the release of the final RIAPCD
Technical Specification Manual, Insurers shall submit files containing member
eligibility as defined in Appendix A-1 of these Regulations for calendar years
2009, 2010, 2011, and 2012, or as specified in the RIAPCD Technical
Specification Manual to the Encrypted Unique Identifier Vendor.
(2) The Encrypted Unique Identifier Vendor shall return the historical member
eligibility file to the Insurer with an assigned Encrypted Unique Identifier within
thirty (30) days of a submission of historical files by an Insurer.
(3) Within three hundred and thirty (330) days of the release of the final RIAPCD
Technical Specification Manual, Insurers shall submit files containing member
eligibility, provider information, and medical and pharmacy claims paid as
defined in Appendix A-2 of these Regulations during calendar years 2009, 2010,
2011, and 2012, or as specified in the RIAPCD Technical Specification Manual,
to the Data Aggregator.
(i)
This submission period may be extended within the discretion of the
Director to up to three hundred and sixty (360) days from the date of release
of the final RIAPCD Technical Specification Manual.
(4) Submissions of additional health care data sets for remaining dates of service in
calendar year 2013 for months up to thirty (30) days prior to three hundredand
thirty (330) days from the date of release of the final RIAPCD Technical
Specification Manual shall be submitted according to a schedule provided within
the RIAPCD Technical Specification Manual.
(c) Regular Data Submissions
10
(1) Upon completion of Historical Data Submissions as required by § 5.2(b) of these
Regulations, Insurers shall commence Regular Data Submissions.
(i)
The timeline for Regular Data Submissions shall commence with the next
month following the completion of Historical Data Submissions.
(2) Insurers shall submit a member eligibility file for each of its members, as defined
in Appendix A-1 of these Regulations, on a monthly basis to the Encrypted
Unique Identifier Vendor.
(i)
Monthly data files are due twenty-one (21) business days after the month’s
end.1
(3) The Encrypted Unique Identifier Vendor shall return the member eligibility file
to the Insurer with an assigned Encrypted Unique Identifier within ten (10)
business days of a regular data submission by an Insurer.
(4) Effective upon ten (10) business days after the receipt of the member eligibility
file from the Encrypted Unique Identifier Vendor, Insurers shall submit files
containing member eligibility, provider information, and medical and pharmacy
claims paid as defined in Appendix A-2 of these Regulations to the Data
Aggregator.
(i)
Monthly health care data files are due within ten (10) business days of
receipt of the assigned Encrypted Unique Identifier by the Insurer.2
(5) Within five (5) business days of the Insurer’s submission to the Data Aggregator,
the Insurer will submit data resubmissions as required by the Data Aggregator
which will communicate discrepancies, failures and resubmissions.
(d) All health care data sets submitted to the Data Aggregator will have a Unique
Identifier attached and shall be protected by the removal of all personally identifiable
information and/or hashed. Under no circumstances shall any Personal Health
Information containing Personally Identifiable Information be submitted to the
Director or Data Aggregator.
(e) The Director has the authority within his or her discretion to modify the RIAPCD
Technical Specification Manual to effect changes to the submissions schedule.
Section 6.0
Compliance with Data Standards
6.1
Standards. The Data Aggregator Vendor shall evaluate each member eligibility file,
provider file, medical claims file and pharmacy claims file in accordance with the
following standards:
1 (For example, files containing data relating to eligibility during September 2013 shall be
submitted by October 30, 2013 (accounts for weekends and holidays.)
2 For example, files containing data relating to services paid during September 2013 shall be
submitted to the Data Aggregator by November 29, 2013 (accounts for weekends and
holidays).
11
(a) The applicable code for each data element shall be as identified in the RIAPCD
Technical Specification Manual and shall be included within eligible values for the
element;
(b) Coding values indicating “data not available”, “data unknown”, or the equivalent
shall not be used for individual data elements unless specified as an eligible value for
the element;
(c) The encrypted unique identifier assigned to each member shall be consistent across
files; and
(d) Files submitted to the Data Aggregator shall not contain personally identifiable
information.
6.2
Notification. Upon completion of this evaluation, the Director or his or her designee will
notify each Insurer whose data submissions do not satisfy the standards for any reporting
period. This notification will identify the specific file and the data elements that are
determined to be unsatisfactory.
6.3
Response. Each Insurer notified under § 6.2 of these Regulations shall resubmit within
ten (10) business days of the date of notification with the required changes.
(a) The Director shall have the discretion to require a response as required by this
subsection in a reasonable time commensurate with the level of difficulty for the level
of correction required to a data submission.
6.4
Compliance. Failure to file, report, or correct health care claims data sets in accordance
with the provisions of these Regulations may be considered a violation of RIGL Chapter
23-17.17 except that an Insurer may seek a variance as specified in § 9.0 of these
Regulations.
Section 7.0
Procedures for the Approval and Release of Claims Data
7.1
Purpose. This subsection pertains to the Rhode Island All Payer Claims Database created
pursuant to RIGL Chapter 23-17.17-9.
7.2
All users of the RIAPCD analytic files, public use files or restricted release files,
including the Department, other Rhode Island state agencies, including vendors with
whom they hold a Business Associate Agreement, and any approved data use applicants
shall comply with all data security and privacy requirements as provided by state and
federal law and regulation.
7.3
Release Policies and Procedures.
(a) General Provisions.
(1) The Department may release restricted release files to a person or organization
engaged in improving, evaluating or otherwise measuring health care provided to
members.
12
(2) The Department may provide pre-determined analytic files at different levels of
detail to meet requests for public use and restricted release analytic files.
(b) Public Use Data Elements.
(1) Pre-developed analytic files may be made available on the Department’s website
in a format approved by the Director.
(2) Additional requests for public use data may be made by submitting a written
request to the Department in conformance with a format to be provided by the
Department.
(c) Unavailable Data Elements. Data elements that are not designated in Appendix A-2
of these Regulations either as public use health care data elements or restricted
release data elements shall not be available for release or use outside of the
Department or other state agencies in any data set or disclosed in publicly released
reports in any circumstance or for any reason.
(d) Restricted Release Files.
(1) Data Use Request Documentation and Agreement. All applicants shall:
(i)
Submit a written application using the format provided by the Department.
The applicant shall specify the data requested, including a justification for
the requested data elements;
(ii) Specify the purpose and intended use of the data requested, including a
detailed project description that describes any other data sources to be used
for the project;
(iii) Specify security and privacy measures that will be used to safeguard patient
privacy and to prevent unauthorized access to or use of such data;
(iv) Specify the applicant's methodology for maintaining data integrity and
accuracy;
(v) Describe how the results of the applicant’s analysis will be published,
including level of aggregation of data that will be presented;
(vi) Agree that cells with six (6) observations or fewer shall never display the
actual number of observations in the cell;
(vii) Agree to the data disclosure restrictions and prohibitions on re-release of the
data;
(viii) Agree that any public report or publication containing information derived
from the data include a provision stating the year or years from which the
data was obtained;
(ix) Attest that the data received pursuant to this application shall never be used
for any purpose other than the project that has been expressly approved
through the application process; and
(x) Obtain written agreement from any recipient of data or agent that processes
data on behalf of the applicant to adhere to the provisions of this agreement.
13
(2) All applications will be posted on the Department’s website for a minimum of ten
(10) business days to invite written public comments on the applications.
However, the Department will not post those portions of applications that specify
security measures or applications from law enforcement entities to the extent that
posting the application on the website may impede the investigatory process.
(3) Data shall not be re-released in any format to anyone except personnel identified
and approved within the original application.
(4) The Department shall be provided with a copy of any proposed public report or
publication containing information derived from the data at least fifteen (15) days
prior to any publication or release to allow the Department to review the
proposed public report or publication and confirm that the conditions of the
written agreement have been applied.
(i)
When multiple public reports or publications, derived from the same data
and of a similar nature, are to be published or released, the Department may,
upon request, waive the requirement that any subsequent reports or
publications be provided to the Department prior to release by the
requesting party.
(5) Applicants for restricted release files shall demonstrate a need for each restricted
data element requested. The Department shall release only those data elements
that are determined to be necessary to accomplish the applicant's intended use.
(6) Applicants requesting Medicare data shall conform to requirements established by
the federal Centers for Medicare and Medicaid Services (CMS) in order to obtain
and use applicable data.
(7) Medicaid data shall not be included in the public use or restricted release files
unless the release of such data conforms to all applicable federal and state laws
and regulations, including laws and regulations governing the de-identification of
such data.
(8) Rhode Island state agencies seeking restricted release data must comply with data
use application processes and procedures.
(9) Restricted Release Data shall not be combined with any other available data
source that could potentially re-identify a member, patient or payer-specific
claims payment amounts.
(e) Data Release Review Board. The Department shall establish a review board for the
purposes of reviewing predetermined analytic files to be made available on the
Department’s website, additional requests for public use data, and requests for public
use of restricted release files.
(f) The Board shall have a chairperson and members appointed annually by the Director.
The appointments to the Board shall be made in such a way as to provide
demonstrated and acknowledged expertise in a diverse range of health care areas
including, but not limited to, state and federal privacy law and data security. The
committee shall be comprised of eleven (11) members and shall include but not be
limited to:
14
(1) At least two members representing health Insurers;
(2) At least one member representing health care facilities;
(3) At least one member representing physicians;
(4) At least one member representing health care consumers;
(5) At least one member representing a privacy protection advocacy organization;
(6) At least one member representing researchers;
(7) At least one member representing the Department;
(8) At least one member representing OHIC;
(9) At least one member representing EOHHS.
(g) The Board will review predetermined analytic files to be made available on the
Department’s website, additional requests for public use data, and requests for public
use of restricted release files to ensure that members, patients and payer-specific
claims payment amounts cannot be identified in any product of the proposed work to
be made available.
(h) The Board shall provide a non-binding recommendation to the Director that shall be
based upon the application criteria set forth in § 7.3(d) of these Regulations.
(i) The Board and Director, as part of their review of whether member, patient and
payer-specific claims payment amounts are safeguarded shall also consider if any
other data available to the applicant or public that the Board or Director is aware of or
reasonably should be aware of could be used to re-identify the member, patient or
payer-specific claims payment amounts.
(j) The Director may approve the application for use of restricted release files if he or
she is also satisfied that the applicant has demonstrated it is qualified to undertake the
study or accomplish the intended use, the applicant requires such files in order to
undertake the study or accomplish the intended use; and the applicant has
demonstrated appropriate privacy and security controls for access to and storage of
restricted release files.
(k) Upon a denial of an application for use of restricted release files by the Director, the
Department shall within fifteen (15) days provide written notice to the applicant of
the basis for denial of the application.
(l) The Director’s decisions to approve or deny applications for use of restricted release
files are final except as provided for in Rhode Island statute.
7.4
Fees. The fee for health care data sets from the RIAPCD, which have been approved for
release by the Department, includes the costs for programming and report generation,
duplicating charges and other costs associated with the production and transmission of
data sets.
(a) The Department and other state agencies may issue reports that are available to the
public at no charge.
15
(b) The fee for an annual public use file consisting of unrestricted fields and data
elements shall be equal to the cost required for the Department to process, package
and ship the data set, including any electronic medium used to store the data, or a
reasonable equivalent if an alternative file delivery model is provided.
(c) The fee for a restricted release file approved by the Department shall be equal to the
cost charged by the Department’s designated vendor to program and process the
requested data extract, including any consulting services and reasonable costs to
package and ship the data set on particular electronic medium.
(d) The fee for preparing customized files shall be equal to the cost charged by the
Department’s designated vendor to program and process the requested customized
data extract, including any consulting services and reasonable costs to package and
ship the data set on a particular electronic medium.
(e) The fee for access to a secure internet portal to create specialized reports based on
restricted data or any other report delivery mechanism not otherwise described shall
be set to reflect the reasonable cost of providing such data.
(f) The fee may be reduced or waived for the following entities at the discretion of the
Department:
(1) CMS;
(2) Rhode Island state agencies; and
(3) Submitting Insurers.
(g) The Director shall have a record of payment in full prior to providing data to
approved applicants.
16
PART III Compliance, Variances, Practices and Procedures and Severability
Section 8.0
Compliance and Enforcement
8.1
Enforcement Options.
(a) The Director may pursue any combination of the following administrative and
judicial enforcement actions, depending upon the circumstances and gravity of each
case:
(1) Compliance orders pursuant to RIGL § 23-1-20;
(2) Immediate compliance orders pursuant to RIGL § 23-1-21;
(3) Enforcement of compliance orders pursuant to RIGL § 23-1-23; and
(4) Criminal penalties pursuant to RIGL § 23-1-25.
(b) The imposition of one or more remedies and/or penalties provided in § 8.1(a) of these
Regulations shall not prevent the Director from jointly exercising any other remedy or
penalty available to him or her by statute or regulation.
(c) Consent Agreement/Order. Nothing in these Regulations shall preclude the Director
from resolving outstanding violations or penalties through a Consent Agreement or
Consent Order at any time he or she deems appropriate.
Section 9.0
Variance Procedure
9.1
The Department may grant a variance from the provisions of a rule or regulation in a
specific case if it finds that enforcement of such provision will result in unnecessary
hardship to the applicant and that such a variance will not be contrary to the public
interest, public health and/or health and safety of residents
Section 10.0 Rules Governing Practices and Procedures
10.1
All hearings and reviews required under the provisions of RIGL Chapter 23-17.17 shall
be held in accordance with the provisions of the Rules and Regulations of the Rhode
Island Department of Health Regarding Practices and Procedures Before the
Department of Health and Access to Public Records of the Department of Health (R42-
35-PP).3
Section 11.0 Severability
11.1
If any provision of these Regulations or their applicability to any person or circumstance
shall be held invalid, such holding shall not affect the provisions or application of the
Regulations that can be given effect, and to this end the provisions of the Regulations are
declared to be severable.
3 Current copies of all regulations issued by the RI Department of Health may be downloaded at no charge from
the RI Secretary of State’s Final Rules and Regulations Database website: http://www.sos.ri.gov/rules/
17
(a) If the effect of such a holding that a provision or application of these Regulations is
invalid is to compromise any of the patient privacy or data security measures
contained herein, such that personally identifiable information may be in any way put
at risk of disclosure, the Director shall have the authority, upon his or her discretion,
to suspend the release of all health care data set(s) and/or analytic files for a period of
time sufficient to address such concerns.
RIAPCD_Final_July2013.doc
Wednesday, 12 June 2013
A1-1
APPENDIX A-1
DATA ELEMENTS FOR PUBLIC USE AND RESTRICTED RELEASE
AND DATA TO BE SUBMITTED BY INSURER
MEMBER ELIGIBILITY FILE TO ENCRYPTED UNIQUE IDENTIFIER VENDOR
Data Element Name
Public Use
Restricted Release
Submitted Data
Elements
Payer Name/Code
No
No
Yes
National Plan ID
No
No
Yes
Insurance Type
/Product/Plan Code
No
No
Yes
Year
No
No
Yes
Month
No
No
Yes
Days Eligible
No
No
Yes
Policy I.D. Number
No
No
Yes
Group Number
No
No
Yes
Group/Employer Name
No
No
Yes
Employer Address
No
No
Yes
Employer City
No
No
Yes
Employer State
No
No
Yes
Employer ZIP Code
No
No
Yes
Employee Status
No
No
Yes
Government Employee
No
No
Yes
Subscriber/Policyholder Last
Name
No
No
Yes
Subscriber/Policyholder First
Name
No
No
Yes
Subscriber/Policyholder
Middle Initial
No
No
Yes
Subscriber/Policyholder
Address 1
No
No
Yes
Subscriber/Policyholder
Address 2
No
No
Yes
Subscriber/Policyholder
Address 3
No
No
Yes
Subscriber/Policyholder City
No
No
Yes
Subscriber/Policyholder
State
No
No
Yes
A1-2
MEMBER ELIGIBILITY FILE TO ENCRYPTED UNIQUE IDENTIFIER VENDOR
Data Element Name
Public Use
Restricted Release
Submitted Data
Elements
Subscriber/Policyholder ZIP
Code
No
No
Yes
Subscriber/Policyholder Data
No
No
Yes
Subscriber/Policyholder SSN
No
No
Yes
Subscriber/Policyholder
Gender
No
No
Yes
Type of Coverage
No
No
Yes
Subtype of Coverage
No
No
Yes
Pharmacy Benefits
Outsourced
No
No
Yes
PBM Name
No
No
Yes
BIN
No
No
Yes, if available
PCN
No
No
Yes
Pharmacy Group Number
No
No
Yes
Pharmacy Policy ID Number
No
No
Yes
Mental Health Benefits
Outsourced
No
No
Optional
Mental Health Carrier Name
No
No
Optional
Network Indicator
No
No
Optional
Name of Network
No
No
Optional
Medicare Part D Indicator
No
No
Optional
Begin Coverage Date
No
No
Optional
End of Coverage Date
No
No
Optional
Relationship to Policy
No
No
Optional
Dependent Indicator
No
No
Optional
Student Indicator
No
No
Optional
Dependent Last Name
No
No
Optional
Dependent First Name
No
No
Optional
Dependent Middle Initial
No
No
Optional
Dependent Address 1
A2-1
APPENDIX A-2
DATA ELEMENTS FOR PUBLIC USE AND RESTRICTED RELEASE
AND DATA TO BE SUBMITTED BY INSURER
MEMBER ELIGIBILITY FILE TO DATA AGGREGATOR
Data Element Name
Public Use
Restricted Release
Submitted Data
Elements
Payer Name/Code
No
Yes
Yes
National Plan ID
No
Yes
Yes
Insurance Type /Product/
Plan Code
No
Yes
Yes
Year
Yes
Yes
Yes
Month
Yes
Yes
Yes
Days Eligible
Yes
Yes
Yes
Insured Group or Policy
Number
No
No
Yes
Coverage Level Code
Yes
Yes
Yes
Plan Specific Contract
Number
No
No
Yes
Encrypted Unique Identifier
No
Yes
Yes
Unique Member ID
(encrypted)
No
Yes
Yes
Unique Subscriber ID
(encrypted)
No
Yes
Yes
Individual Relationship Code
Yes
Yes
Yes
Member Gender
Yes
Yes
Yes
Member City Name
No
Yes
Yes
Member State or Province
Yes
Yes
Yes
Member ZIP Code
Yes: 3 digits
Yes: 5 digits (but
reported at 3)
Yes
Medical Coverage
Yes
Yes
Yes
Prescription Drug Coverage
Yes
Yes
Yes
Race and Ethnicity
Yes, if available
Yes, if available
Yes
Primary Insurance Indicator
Yes
Yes
Yes
Coverage Type
Yes
Yes
Yes
Market Category Code
No
No
Yes
Special Coverage
No
No
Yes
Record Type
Yes
Yes
Yes
A2-2
MEMBER ELIGIBILITY FILE TO DATA AGGREGATOR
Data Element Name
Public Use
Restricted Release
Submitted Data
Elements
(Hashed) Subscriber SSN
No
No
Yes
(Hashed) Subscriber last
name
No
No
Yes
(Hashed) Subscriber first
name
No
No
Yes
(Hashed) Subscriber middle
initial
No
No
Yes
(Hashed) Member SSN
No
No
Yes, if available
(Hashed) Member last name
No
No
Yes
(Hashed) Member first name
No
No
Yes
(Hashed) Member middle
initial
No
No
Yes
(Hashed) Member Date of
Birth
Age or age bands
will be displayed,
Age or age bands
will be displayed,
Yes
B-1
MEDICAL CLAIMS DATA FILE
Data Element Name
Public Use
Restricted Release
Submitted Data
Elements
Payer
No
Yes
Yes
National Plan ID
No
Yes
Yes
Insurance Type/Product/Plan
Code
No
Yes
Yes
Payer Claim Control Number
Hashed
Hashed
Yes
Line Counter
Yes
Yes
Yes
Version Number
No
No
Yes
Carrier Specific Insured
Group or Policy Number
No
No
Yes
Plan Specific Contract
Number
No
No
Yes
Encrypted Unique Identifier
No
Yes
Yes
Unique Member
Identification
No
Yes
Yes
Unique Subscriber ID
(encrypted)
No
Yes
Yes
Individual Relationship Code
Yes
Yes
Yes
Member Gender
Yes
Yes
Yes
Member Date of Birth
Age or age bands
will be displayed,
Age or age bands
will be displayed,
Yes
Member City Name
No
Yes
Yes
Member State or Province
Yes
Yes
Yes
Member ZIP Code
3 digit
5 digits in file, but
reported out at 3
digit level
Yes
Date Service Approved/
Accounts Payable Date/
Actual Paid Date
No
MMYY
Yes
Admission Date
If Needed,
If Needed, MMYY
Yes
Admission Hour
No
If Needed
Yes
Admission Type
If Needed
If Needed
Yes
Service Provider Number
No
Yes
Yes
Service Provider Tax ID
Number
No
If Needed
Yes
Service National Provider ID
No
If Needed
Yes
B-2
MEDICAL CLAIMS DATA FILE
Data Element Name
Public Use
Restricted Release
Submitted Data
Elements
Service Provider Entity Type
Qualifier
Yes, If Needed
Yes
Yes
Service Provider First Name
No
If Needed
Yes
Service Provider Middle
Name
No
No
Yes
Service Provider Last Name
or Organization Name
No
If Needed
Yes
Service Provider Suffix
No
No
Yes
Service Provider Specialty
Yes
Yes
Yes
Service Provider City Name
Yes
Yes
Yes
Service Provider State or
Province
Yes
Yes
Yes
Service Provider ZIP Code
Yes
Yes
Yes
Type of Bill – Institutional
Yes
Yes
Yes
Facility Type - Professional
Yes
Yes
Yes
Admitting Diagnosis
Yes
Yes
Yes
E-Code
Yes
Yes
Yes
Diagnosis present on
Admission (1-25)
Yes
Yes
Yes
Principal Diagnosis (1)
Yes
Yes
Yes
Other Diagnosis (2-25)
Yes
Yes
Yes
Revenue Code
Yes
Yes
Yes
Procedure Code (HCPCS
includes CPT)
Yes
Yes
Yes
Procedure Modifier – 1
Yes
Yes
Yes
Procedure Modifier – 2
Yes
Yes
Yes
ICD-9-CM Procedure Code
(1 through 25)
Yes
Yes
Yes
Date of Service – From
MMYY
DDMMYY
Yes
Date of Service – Thru
MMYY
DDMMYY
Yes
Quantity
No
Yes
Yes
Charge Amount
Yes, If Needed
Yes
Yes
Paid Amount
Yes
Yes
Yes
Prepaid Amount
Yes
Yes
Yes
Co-pay Amount
Yes
Yes
Yes
B-3
MEDICAL CLAIMS DATA FILE
Data Element Name
Public Use
Restricted Release
Submitted Data
Elements
Coinsurance Amount
Yes
Yes
Yes
Coordination of Benefits
Paid Amount
Yes
Yes
Yes
Deductible Amount
Yes
Yes
Yes
Patient Account/Control
Number
No
Yes
Yes
Discharge Date
CCYYMM if
CCYYMM if
Yes
DRG
Yes if available
Yes if available
Yes
DRG Version
Yes if DRG is
included
Yes if DRG is
included
Yes
APC
Yes
Yes
Yes
APC Version
Yes if APC is
included
Yes if APC is
included
Yes
Drug Code
No
Yes
Yes
Billing Provider Number
No
Yes
Yes
National Billing Provider ID
No
Yes
Yes
Billing Provider Last Name
or Organization Name
No
Yes
Yes
Record Type
Yes
Yes
Yes
B-4
PROVIDER FILE
Data Element Name
Public Use
Restricted Release
Submitted Data
Elements
Payer
No
Yes
Yes
National Provider ID/Plan
Provider ID
No
No
Yes
Tax Id
No
No
Yes
UPIN Id
Yes
Yes
Yes
DEA ID
No
No
Yes
License Id
No
No
Yes
Medicaid Id
No
No
Yes
Last Name
No
Yes
Yes
First Name
No
Yes
Yes
Middle Initial
No
Yes
Yes
Suffix
Yes
Yes
Yes
Entity Name
Yes
Yes
Yes
Entity Code
Yes
Yes
Yes
Gender Code
Yes
Yes
Yes
DOB Date
No
No
Yes
Street Address1 Name
No
No
Yes
Street Address2 Name
No
No
Yes
City Name
Yes
Yes
Yes
State Code
Yes
Yes
Yes
Country Code
Yes
Yes
Yes
Zip Code
Yes
Yes
Yes
Taxonomy
Yes
Yes
Yes
Mailing Street Address1
Name
Yes
Yes
Yes
Mailing Street Address2
Name
Yes
Yes
Yes
Mailing City Name
Yes
Yes
Yes
Mailing State Code
Yes
Yes
Yes
Mailing Zip Code
Yes
Yes
Yes
Primary Specialty Code
Yes
Yes
Yes
B-5
PHARMACY FILE
Data Element Name
Public Use
Restricted Release
Submitted Data
Elements
Payer
No
Yes
Yes
National Plan ID
No
Yes
Yes
Insurance Type/Product/Plan
Code
No
Yes
Yes
Payer Claim Control Number
Hashed
Hashed
Yes
Line Counter
No
No
Yes
Insured Group Number
No
No
Yes
Plan Specific Contract
No
No
Yes
Encrypted Unique Identifier
No
Yes
Yes
Unique Member
Identification
No
Yes
Yes
Individual Relationship Code
Yes
Yes
Yes
Member Gender
Yes
Yes
Yes
Member Date of Birth
Age or age bands
will be displayed,
not DOB
Age or age bands
will be displayed,
not DOB
Yes
Member City
Yes
No
Yes
Member State or Province
Yes
Yes
Yes
Member ZIP Code
3 digit
5 digits in file, but
reported out at 3
digit level
Yes
Date Service Approved (AP
Date)
No
MMYY
Yes
Pharmacy Number
No
Yes
Yes
Pharmacy Tax ID Number
No
Yes
Yes
Pharmacy Name
No
Yes
Yes
National Provider ID
Number
No
Yes
Yes
Pharmacy Location City
Yes
Yes
Yes
Pharmacy Location State
Yes
Yes
Yes
Pharmacy ZIP Code
Yes
Yes
Yes
Pharmacy Country Name
Yes
Yes
Yes
Claim Status
No
No
Yes
Drug Code
No
Yes
Yes
B-6
PHARMACY FILE
Data Element Name
Public Use
Restricted Release
Submitted Data
Elements
Drug Name
Yes
Yes
Yes
New Prescription or Refill
Yes
Yes
Yes
Generic Drug Indicator
Yes
Yes
Yes
Dispense as Written Code
Yes
Yes
Yes
Compound Drug Indicator
No
Yes
Yes
Date Prescription Filled
CCYYMM
CCYYMMDD
Yes
Quantity Dispensed
Yes
Yes
Yes
Days’ Supply
Yes
Yes
Yes
Charge Amount
Yes
Yes
Yes
Paid Amount
Yes
Yes
Yes
Ingredient Cost/List Price
Yes
Yes
Yes
Postage Amount Claimed
Yes
Yes
Yes
Dispensing Fee
Yes
Yes
Yes
Co-pay Amount
Yes
Yes
Yes
Coinsurance Amount
Yes
Yes
Yes
Coordination of Benefits
Paid Amount
Yes
Yes
Yes
Deductible Amount
Yes
Yes
Yes
Prescribing Provider ID
No
Yes
Yes
Prescribing Physician First
Name
No
Yes
Yes
Prescribing Physician Middle
Name
No
Yes
Yes
Prescribing Physician Last
Name
No
Yes
Yes
Prescribing Physician Plan
Number
No
Yes
Yes
Unique Subscriber ID
(encrypted)
No
No
Yes
Prescribing Physician DEA
No.
No
Yes
Yes
Prescribing Physician Lic.
No.
No
Yes
Yes
Prescribing Physician Street
Address
No
Yes
Yes
Prescribing Physician State
No
Yes
Yes
B-7
PHARMACY FILE
Data Element Name
Public Use
Restricted Release
Submitted Data
Elements
Prescribing Physician City
No
Yes
Yes
Prescribing Physician ZIP
No
Yes
Yes
Mail Order Pharmacy
Yes
Yes
Yes