Drug and health care claims data release

(a)

In general

Section 1860D–42 of the Social Security Act (42 U.S.C. 1395w–152) is amended by adding at the end the following new subsection:

(c)

Drug and health care claims data release

(1)

Drug and health care claims data release

Notwithstanding any provision under this part that limits the use of prescription drug data collected under this part, for the purpose of improving the public’s health through research on the safety, effectiveness, and quality of health care services provided under the program under this title, the Secretary shall— (A)utilize such data collected; and (B)acting through the Centers for Medicare & Medicaid Services— (i)enter into data release agreements on an annual basis with the agencies described in paragraph (2) to provide access to relevant data submitted by prescription drug plans and MA–PD plans under this part, excluding negotiated price concessions (such as discounts, direct or indirect subsidies, rebates, and direct or indirect remunerations), and linked to hospital, physician, and other relevant medical claims, utilization, and diagnostic data collected under this title and title XIX; and (ii)permit agencies described in paragraph (2) to link data provided under this subsection with other relevant health data, including survey data, vital statistics, and disease registries, as needed by the agency in order to accomplish its research objectives. (2)

Agencies described

The agencies described in this paragraph are as follows: (A)The Food and Drug Administration. (B)The Centers for Disease Control and Prevention. (C)The Agency for Healthcare Research and Quality. (D)The National Institutes of Health. (E)Any other agency or center within the Department of Health and Human Services as the Secretary determines appropriate. (3)

Use of the data provided

Data provided under a data release agreement under paragraph (1)(B)(i) shall only be used for the following purposes: (A)

FDA

In the case of the Food and Drug Administration, to enhance postmarketing surveillance by— (i)studying health risks associated with such utilization, particularly with respect to improving the speed of risk identification in order to mitigate or resolve such risks; and (ii)performing such other functions, consistent with the purposes of this subsection and the mission of the Food and Drug Administration, as are determined appropriate by the Secretary. (B)

CDC

In the case of the Centers for Disease Control and Prevention, to— (i)improve surveillance of clinical outbreaks and emerging threats; (ii)study immunization rates; (iii)study outcomes of specific diseases; (iv)develop and monitor the use of preventive screening protocols using claims data; (v)study drug and medical utilization in order to promote consumer education and treatment for specific public health risks; and (vi)perform such other functions, consistent with the purposes of this subsection and the mission of the Centers for Disease Control and Prevention, as are determined appropriate by the Secretary. (C)

AHRQ

In the case of the Agency for Healthcare Research and Quality, to— (i)carry out the research obligations of the Agency for Healthcare Research and Quality under section 1013 of the Medicare Prescription Drug, Improvement, and Modernization Act of 2003; (ii)conduct research consistent with the mission of the Agency for Healthcare Research and Quality to improve the quality, safety, efficiency, and effectiveness of health care; and (iii)perform such other functions, consistent with the purposes of this subsection and such mission, as are determined appropriate by the Secretary. (D)

NIH

In the case of the National Institutes of Health, to— (i)help prevent, detect, diagnose, and treat disease and disabilities; and (ii)perform such other functions, consistent with the purposes of this subsection and the mission of the National Institutes of Health, as are determined appropriate by the Secretary. (E)

Other agency or center within the Department of Health and Human Services

In the case of an agency or center described in paragraph (2)(E), to conduct research, consistent with the purposes of this subsection and the activities conducted under subparagraphs (A) through (D), as determined appropriate by the Secretary. (4)

Timeframe for data release

A data release agreement entered into under this subsection shall provide for the release of information as needed by an agency described in paragraph (2) for the uses described in paragraph (3). (5)

Data release procedures

(A)

Determining appropriate level and elements of data for release

(i)

In general

The Secretary shall establish a process to determine the appropriate level and elements of data to be released to an agency described in paragraph (2) under this subsection in order to ensure that the agency, and researchers within the agency, are able to conduct meaningful analyses while maintaining the confidentiality of the data provided under the data release agreement. (ii)

Relationship to procedures for release to private researchers

The process established under clause (i) may be analogous to the process used by the Centers for Medicare & Medicaid Services for the release of data to private researchers. (B)

Agency feedback on analyses conducted

The Secretary shall establish a process for agencies described in paragraph (2) that are provided data under a data release agreement under this subsection to provide the results of the analyses conducted using such data to the Centers for Medicare & Medicaid Services for use in the administration and assessment of programs administered by the Centers for Medicare & Medicaid Services, including the program under this part. (C)

Review of data procedures

The Secretary shall establish a process to review and update the following: (i)The processes established under subparagraphs (A)(i) and (B). (ii)Procedures for transmission and retention of data released under this subsection. (6)

Notification of inaccuracies discovered in data provided

The Secretary shall establish procedures to ensure that an agency described in paragraph (2) that is provided data under this subsection notifies the Secretary of any inaccuracies discovered in the data by the agency within a reasonable time of such discovery. (7)

Access by contractors and subcontractors

In the case of a public or private entity that enters into a contract or subcontract with an agency described in paragraph (2) to conduct activities for such agency under this subsection, any access by such entity to data from the program under this title under this subsection shall be provided in accordance with, and subject to the same requirements under, subsection (d) (other than the requirement under paragraph (4)(B)(ii)(V)(aa) of subsection (d), unless the Secretary determines that the application of such requirement is appropriate). (8)

Report

The Secretary shall report to Congress on an annual basis (beginning with 2008) an evaluation of the data release agreements entered into under paragraph (1)(B)(i), including a list and a description of the reports and analyses conducted by agencies using data provided under such an agreement. (9)

Authorization of appropriations

There are authorized to be appropriated such sums as are necessary to carry out the purposes of this subsection.

(b)

Research center and organization drug and health care data use

(1)

In general

Section 1860D–42 of the Social Security Act (42 U.S.C. 1395w–152), as amended by subsection (a), is amended by adding at the end the following new subsection:

(d)

Research center and organization drug and health care data use

(1)

In general

Notwithstanding any provision under this part that limits the use of prescription drug data collected under this part, for the purpose of improving the public’s health through research on the safety, effectiveness, and quality of health care services provided under the program under this title, the Secretary shall— (A)enter into data use agreements with the research centers and organizations described in paragraph (2) to provide access to relevant data submitted by prescription drug plans and MA–PD plans under this part, excluding negotiated price concessions (such as discounts, direct or indirect subsidies, rebates, and direct or indirect remunerations), and linked to hospital, physician, and other relevant medical claims, utilization, and diagnostic data collected under this title and title XIX; (B)permit research centers and organizations described in paragraph (2) to link data provided under this subsection with other relevant health data, including survey data, vital statistics, and disease registries, as needed by the research center or organization in order to accomplish its research objectives; and (C)prepare the linked sets of data described in subparagraph (A) for release not later than July 1, 2008. (2)

Research centers and organizations described

The research centers and organizations described in this paragraph are as follows: (A)A university-based research center. (B)Any other research center or organization— (i)whose primary mission is to conduct public research on the safety, effectiveness, and quality of health care services; and (ii)which the Secretary determines can appropriately conduct analyses consistent with the purposes of this subsection. (3)

Use of data and penalties

(A)

Use of data

(i)

In general

Data provided to a research center or organization under a data use agreement under this subsection shall be used solely for purposes of research on the safety, effectiveness, and quality of, disparities in, and related aspects of, health care use by individuals entitled to, or enrolled for, benefits under part A, or enrolled for benefits under part B, conducted for the purpose of developing and providing generalizable knowledge to inform the public health through scientific publication and other forms of public dissemination. (ii)

Approval by Review Board for the Protection of Human Subjects

Such use shall be approved by a review board for the protection of human subjects. (iii)

Review process

The Secretary shall establish a review process to ensure that— (I)data use agreements under this subsection include a detailed description of how the data is to be used under the agreement; and (II)such use is consistent with the purposes described in clause (i). (B)

Penalties

(i)

In general

A research center or organization who knowingly or intentionally uses data provided under a data use agreement under this subsection for any purpose other than the purposes described in subparagraph (A)(i) shall be subject, in addition to any other penalties that may be prescribed by law, to— (I)a civil money penalty of not less than $25,000 for each infraction; and (II)disqualification from receipt of any data under this section for not less than 2 years. (ii)

Procedure

The provisions of section 1128A (other than subsections (a) and (b) and the second sentence of subsection (f)) shall apply to a civil money penalty under this subparagraph in the same manner as such provisions apply to a penalty or proceeding under section 1128A(a). (4)

Release of data

(A)

In general

A data use agreement entered into under paragraph (1)(A) shall provide for the release of information— (i)according to a schedule approved by the Secretary under the criteria developed in accordance with subparagraph (B); and (ii)for a timeframe appropriate to accomplish the research objective (as determined by the Secretary). (B)

Criteria for approving research applications

(i)

Development

The Secretary, in consultation with health services researchers and academicians, shall develop criteria for the approval of a data use agreement under this subsection. (ii)

Criteria

The criteria developed under clause (i) shall include the following requirements: (I)The research center or organization has well-documented scientific expertise, a record of scholarship on the topic of the proposed study, and a likelihood of successful publication, as demonstrated by a prior record of relevant publication by key staff and other evidence of appropriate scientific qualifications of the proposed research team. (II)The research center or organization demonstrates a credible capability to conduct and complete the proposed study, including experience with scientific investigations using similar types of data. (III)The research center or organization demonstrates the public health importance of the proposed study, and the potential of such study to provide public knowledge needed to improve the safety, use, and outcomes of treatments, the administration of the program under this title, and the care provided to individuals entitled to, or enrolled for, benefits under part A, or enrolled for benefits under part B. (IV)The research center or organization develops a data management plan that describes in detail the measures that will be implemented to safeguard the data and protect the privacy of individuals entitled to, or enrolled for, benefits under part A, or enrolled for benefits under part B, including any proposed data linkages. (V)The research center or organization enters into an agreement under which the research center or organization agrees to— (aa)place detailed results of the proposed study in the public domain through publication in a reasonable timeframe, not to exceed 1 year after completion of such study, including a thorough description of the methodology used to conduct the study; (bb)make available to the public, without charge, any product or tool developed using the data provided under this subsection; and (cc)not sell such data to other entities or create commercial data products (such as data extracts or analytical files) using such data. (VI)The research center or organization and the proposed research team provide assurances that such team is independent from the sources of funding or any other party and has the right to independently and freely publish the scientific findings of the study. (VII)Such other requirements, consistent with the purposes of this subsection, as the Secretary determines appropriate. (C)

Timely review and action on requests

The Secretary shall provide for timely review of, and action on, requests for a data use agreement under this subsection, taking into consideration the reasonable needs of the research center or organization. (D)

Public disclosure

The Secretary shall make available to the public the criteria developed under subparagraph (B)(i) that is used to grant or deny a data use agreement under this subsection. (5)

Feedback by research center or organization

(A)

Notification of inaccuracies discovered in data provided

The Secretary shall establish procedures to ensure that a research center or organization that is provided data under this subsection notifies the Secretary of any inaccuracies discovered in the data by the center or organization within a reasonable time of such discovery. (B)

Feedback on data collection

The Secretary shall permit researchers to provide feedback on the collection of data with respect to the programs administered by the Centers for Medicare & Medicaid Services and make recommendations with respect to the collection of additional data elements with respect to such programs. (6)

Confidentiality

(A)

Determining appropriate level of data to be provided

The Secretary shall establish a process to determine the appropriate level of data to be provided to a research center or organization under this subsection in order to ensure that the center or organization, and researchers within the center or organization, are able to conduct meaningful analyses while maintaining the confidentiality of the data provided under the data use agreement. (B)

Safeguards to protect confidentiality of data provided

(i)

In general

The Secretary shall establish safeguards to protect the confidentiality of data after it is provided to a research center or organization under this subsection. Such safeguards shall not provide for greater disclosure by the research center or organization than is permitted under any of the following: (I)The Federal regulations (concerning the privacy of individually identifiable health information) promulgated under section 264(c) of the Health Insurance Portability and Accountability Act of 1996. (II)Sections 552 or 552a of title 5, United States Code, with regard to the privacy of individually identifiable beneficiary health information. (ii)

Confidentiality of physicians and medical practices

The safeguards established under clause (i) shall ensure that the data provided to a research center or organization under this subsection that identifies individual physicians or medical practices is not released by the research center or organization, or otherwise made public in a manner that identifies individual physicians or medical practices. (7)

Access by contractors and subcontractors

In the case of a public or private entity that enters into a contract or subcontract with a research center or organization described in paragraph (2) to conduct activities for such research center or organization under this subsection, any access by such entity to data from the program under this title under this subsection shall be provided in accordance with this subsection and subject to the same requirements as access for a research center or organization under this subsection. (8)

Report

The Secretary shall report to Congress on an annual basis (beginning with 2008) an evaluation of the agreements entered into under paragraph (1)(A), including a list and a description of the research conducted by research centers and organizations using data provided under such an agreement. (9)

Reasonable fee

The Secretary may charge a research center or organization a reasonable fee based on the cost of preparing and providing data to such center or organization under this subsection.

(2)

Criteria development and publication

The Secretary shall develop and publish the criteria required under section 1860D–42(d)(4)(B)(i) of the Social Security Act, as added by paragraph (1), not later than 180 days after the date of enactment of this Act.