On December 7, 2011, the U.S. Department of Health and Human Services, Centers for Medicare and Medicaid Services (CMS) published a final rule¹ (Final Rule) that would give employers and consumers access to certain Medicare data they could use to evaluate the performance of physicians and hospitals.

The Final Rule implements a provision in the Patient Protection and Affordable Care Act (ACA) intended to enable health plans and consumers to make more educated health care choices. Specifically, Section 10332 of ACA amends Section 1874 of the Social Security Act to require that standardized extracts of Medicare claims data under parts A, B and D be made available to "qualified entities" (Qualified Entities) for the evaluation of health care provider and supplier performance. Qualified Entities receiving the Medicare data must publically release a report on the performance of providers and suppliers.

The Final Rule becomes effective January 6, 2012.

Qualified Entities

Both public and private entities may be eligible to participate in the program as Qualified Entities. A Qualified Entity does not need to be a single organization and applicants can contract with other organizations to meet eligibility criteria. In determining the eligibility standards for Qualified Entities, CMS stated that the agency sought to balance the need to ensure the production of timely, high quality and actionable performance reports with the need to both protect Medicare beneficiary privacy and ensure that providers and suppliers have an appropriate amount of time to review, appeal and correct reports prior to public reporting.² Accordingly, Qualified Entities must demonstrate organizational and governance capability, have access to claims data from non-Medicare sources, and have a rigorous privacy and security program in place. In order to be eligible to participate in the programs, the entity must submit an application to CMS and be deemed able to evaluate the performance of providers and suppliers on measures of quality, efficiency, effectiveness and resource use. Qualified Entities must have at least three years' experience in these areas. The Final Rule does not limit the number of Qualified Entities eligible to serve in a geographic region.

Once approved, a Qualified Entity can participate in the program for three years, after which time it must reapply. CMS will monitor and assess Qualified Entities and their contractors, including through audits. A Qualified Entity must pay CMS a fee equal to the cost of making the data Medicare data available. CMS had initially estimated that the cost of providing the data for 2.5 million beneficiaries would be $200,000, of which $75,000 is the cost of the claims data and $125,000 is the cost of making the data available. In response to concerns that the high cost would be a barrier to participation, CMS has narrowed the scope of what it considers to be the cost of making the data available and made the process more efficient, thereby reducing the fee charged to Qualified Entities. CMS now estimates that the total cost to provide data on 2.5 million beneficiaries will be $40,000 in the first year of the program. After the first year, Qualified Entities would get quarterly updates of Medicare data, each for a fee of $8,000. These estimates are predicated on 25 Qualified Entities participating in the program, and will be lower if more organizations participate.

Data Use Agreement

Each Qualified Entity must maintain a rigorous data privacy and security program. A Qualified Entity and each of its contractors must sign a Data Use Agreement (DUA) with CMS. The DUA will specify how Medicare data will be stored and transmitted. Violations of the DUA can result in termination of the Qualified Entity's access to Medicare data.

Performance Measures and Reports

The Final Rule specifies that Qualified Entities are not allowed to measure performance based on Medicare data alone. They must include claims data from non-Medicare sources as well. Some commenters to the proposed rule requested that Qualified Entities be allowed to combine claims data with clinical data to measure the performance. Acknowledging the value of clinical data, the Final Rule allows Qualified Entities to use clinical data in combination with Medicare and other claims data to calculate performance measurement. The Final Rule also gives these organizations more flexibility in the use of the Medicare claims data to generate performance reports.

A Qualified Entity must produce a performance report at least annually. Before releasing the report to the public, the Qualified Entity first must provide a confidential draft to the providers and suppliers identified in the report. Physicians, hospitals and other providers or suppliers included in the report will have at least 60 days, instead of only 30 days as originally proposed, to review, correct and appeal the report before it becomes public. To ensure beneficiary privacy, the public reports may only include data on providers or suppliers at the provider or supplier level. The public report may not include any patient identifiers.

Some commenters to the proposed rule had requested that Qualified Entities be allowed to use the Medicare data for other purposes, such as internal analysis, pay-for-performance initiatives, and provider tiering. CMS rejected the request to expand the use of the data for other purposes. The Final Rule provides that the DUA will, among other things, reaffirm the statutory ban on using the Medicare data other than for the performance reports on providers and suppliers. Although a Qualified Entity can only use the Medicare data and derivative data to create the performance reports, the public report results can be used by anyone, including Qualified Entities, for pay-for-performance and other initiatives.

Impact on Health Care Providers, Health Plans and Consumers

CMS estimates that 95% of recipients of the draft performance reports will be physicians and 5% will be hospitals and other suppliers. In its regulatory impact analysis, the agency acknowledges that reviewing and appealing the reports will be a burden for health care providers and suppliers. However, CMS contends that there also will be many benefits for providers and suppliers, as well as for the Medicare program, consumers, and purchasers. CMS expects that providers and suppliers will receive one report covering a majority of their patients, rather than a report from each payor. CMS further contends that the transparency of performance results will help providers and suppliers improve quality and reduce costs.

According to Marilyn Tavenner, Acting CMS Administrator, "This provision of the health care law will ensure consumers have the access they deserve to information that will help them receive the highest quality care at the best value for their dollar."³ Tapping into the vast Medicare data to create performance report cards is expected to give private health plans a new tool to improve health care quality and reduce cost. While the ultimate impact of these report cards on health care quality and cost remains to be seen, the ACA requirement and Final Rule raise important considerations for providers as well as consumers of health care.

¹ 76 Fed. Reg. 76,542 (Dec. 7, 2011).

² 76 Fed. Reg. at 76,543.

³ See Press Release, Centers for Medicare and Medicaid Services, Medicare Gives Employers, Consumers Information to Make Better Health Care Choices (Dec. 5, 2011), available at www.cms.gov/apps/media/press/release.asp?Counter=4206&intNumPerPage=1000&checkDate=&checkKey=&srchType=1&numDays=0&sr.

Ilyse Schuman is a Shareholder in Littler Mendelson's Washington, D.C. office. If you would like further information, please contact your Littler attorney at 1.888.Littler, info@littler.com, or Ms. Schuman at ischuman@littler.com.