[Federal Register Volume 73, Number 103 (Wednesday, May 28, 2008)]
[Rules and Regulations]
[Pages 30664-30685]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 08-1298]



[[Page 30663]]

-----------------------------------------------------------------------

Part II





Department of Health and Human Services





-----------------------------------------------------------------------



Centers for Medicare & Medicaid Services



-----------------------------------------------------------------------



42 CFR Part 423



Medicare Program; Medicare Part D Claims Data; Final Rule

  Federal Register / Vol. 73, No. 103 / Wednesday, May 28, 2008 / Rules 
and Regulations  

[[Page 30664]]


-----------------------------------------------------------------------

DEPARTMENT OF HEALTH AND HUMAN SERVICES

Centers for Medicare & Medicaid Services

42 CFR Part 423

[CMS-4119-F]
RIN 0938-AO58


Medicare Program; Medicare Part D Claims Data

AGENCY: Centers for Medicare & Medicaid Services (CMS), HHS.

ACTION: Final rule.

-----------------------------------------------------------------------

SUMMARY: This final rule allows the Secretary to collect claims data 
that are presently being collected for Part D payment purposes for 
other research, analysis, reporting, and public health functions. The 
Secretary needs to use these data because other publicly available data 
are not, in and of themselves, sufficient for the studies and 
operations that the Secretary needs to undertake as part of the 
Department of Health and Human Service's obligation to oversee the 
Medicare program, protect the public's health, and respond to 
Congressional mandates. These data will also be used to better 
identify, evaluate and measure the effects of the Medicare 
Modernization Act of 2003, (MMA).

DATES: Effective Date: This regulation is effective June 27, 2008. Date 
of Applicability: This regulation applies to Part D claims data 
collected on or after January 1, 2006. Following the effective date of 
this final rule, we will recollect under section 1860D-12(b)(3)(D) of 
the Act any data that were first submitted prior to the effective date 
of this final rule by extracting them from the Part D claims data 
already collected for payment purposes.

FOR FURTHER INFORMATION CONTACT: Alissa DeBoy, (410) 786-6041; Nancy 
DeLew, (202) 690-7351.

SUPPLEMENTARY INFORMATION: Copies: To order copies of the Federal 
Register containing this document, send your request to: New Orders, 
Superintendent of Documents, P.O. Box 371954, Pittsburgh, PA 15250-
7954. Specify the date of the issue requested and enclose a check or 
money order payable to the Superintendent of Documents, or enclose your 
Visa or Master Card number and expiration date. Credit card orders can 
also be placed by calling the order desk at (202) 512-1800 (or toll 
free at 1-888-293-6498) or by faxing to (202) 512-2250. The cost for 
each copy is $10. As an alternative, you can view and photocopy the 
Federal Register document at most libraries designated as Federal 
Depository Libraries and at many other public and academic libraries 
throughout the country that receive the Federal Register. This Federal 
Register document is also available from the Federal Register online 
database through GPO Access, a service of the U.S. Government Printing 
Office. The Web site address is: http:// www.access.gpo.gov/fr/index.html.

I. Background

A. Requirements for Issuance of Regulations

    Section 902 of the Medicare Prescription Drug, Improvement, and 
Modernization Act of 2003 (MMA) (Pub. L. 108-173) amended section 
1871(a)(3) of the Social Security Act (the Act) and requires the 
Secretary, in consultation with the Director of the Office of 
Management and Budget (OMB), to establish and publish timelines for the 
publication of Medicare final regulations based on the previous 
publication of a Medicare proposed or interim final regulation. Section 
1871(a)(3)(B) of the Act also states that the timelines for these 
regulations may vary, but shall not exceed 3 years after publication of 
the preceding proposed or interim final regulation, except under 
exceptional circumstances. This final rule finalizes provisions set 
forth in our October 18, 2006 proposed rule. In addition, this final 
rule is being published within the 3-year time limit imposed by section 
1871(a)(3)(B) of the Act. Therefore, we believe that the final rule is 
in accordance with the Congress's intent to ensure timely publication 
of final regulations.

B. General Overview

    As stated in the October 18, 2006 proposed rule, under the Act, the 
Secretary has the authority to include in Part D sponsor contracts any 
terms or conditions the Secretary deems necessary and appropriate, 
including requiring the organization to provide the Secretary with such 
information as the Secretary may find necessary and appropriate. (See 
section 1857(e)(1) of the Act as incorporated into Part D through 
section 1860D-12(b)(3)(D) of the Act.)
    We proposed to implement section 1860D-12(b)(3)(D) of the Act to 
allow the Secretary to collect the same claims information now 
collected under the authority of section 1860D-15 of the Act for 
purposes including reporting to the Congress and the public, conducting 
evaluations of the overall Medicare program, making legislative 
proposals to Congress, and conducting demonstration projects. While the 
purposes underlying such collection are discussed in more detail in 
this final rule, they include, but are not limited to, evaluating the 
effectiveness of the new prescription drug benefit and its impact on 
health outcomes, performing Congressionally mandated or other 
demonstration and pilot projects and studies, reporting to Congress and 
the public regarding expenditures and other statistics involving the 
new Medicare prescription drug benefit, studying and reporting on the 
Medicare program as a whole, and creating a research resource for the 
evaluation of utilization and outcomes associated with the use of 
prescription drugs.
    We note that because this final rule applies to all Part D 
sponsors, it applies to any entity offering a Part D plan, including 
both prescription drug plan sponsors and Medicare Advantage 
organizations offering qualified prescription drug coverage. We further 
note that the Part D prescription drug event data (hereinafter also 
referred to as ``Part D claims data'') collected in accordance with 
section 1860D-12(b)(3)(D) of the Act will include 37 drug claim 
elements submitted by drug plan sponsors to the Secretary, which in 
accordance with Sec.  423.100, include not only data from claims for 
drugs, but also data from claims for insulin, biological products, 
certain medical supplies, and vaccines.

II. Provisions of the Proposed Rule With an Analysis of and Response to 
Public Comments

    We received approximately 118 items of timely correspondence 
containing comments on the October 18, 2006 proposed rule. Commenters 
included health policy organizations, pharmacies and pharmacy-related 
organizations, members of the Congress, researchers, insurance industry 
representatives, physicians and other health care professionals, 
beneficiary advocacy groups, representatives of hospitals, Part D 
beneficiaries, a pharmacy benefit managers' trade association and 
others.
    In this final rule, we address all comments and concerns on the 
policies included in the proposed rule. The following lists the 
provisions of the proposed rule that received the most comments:
     External access to the data
     Uses for the data
     Privacy protections for the data
    Generally, the vast majority of commenters expressed strong support 
for the proposed rule, declaring it essential for the success and 
accurate evaluation of the Medicare Part D program. There was also a 
significant

[[Page 30665]]

amount of agreement among the commenters that external entities be 
allowed access to Part D claims data. Commenters pointed out that CMS 
could not possibly fund all the research needed, and because of that, 
allowing external entities access to these data is necessary in order 
to evaluate the many health care issues arising from the new 
prescription drug benefit. Commenters also noted that research by 
external entities is likely to result in lower government expenditures 
and better delivery of health care to beneficiaries. Many of the 
commenters supporting the rule cited multiple examples of the potential 
benefits to the public health that could result with the access to Part 
D claims data by qualified organizations and individuals, including 
assessing the impact prescription drugs have on the health outcomes of 
the elderly, cost efficiencies, quality of care measures, and the 
efficacy of prescription drugs.
    A number of comments addressed privacy protections, which impact 
the collection and release of claims data, and other commenters 
expressed concern about sensitive financial information being released. 
The majority of commenters acknowledged that a risk to protected 
information exists; however, they believed that the risk is no greater 
than the risk involved when allowing access to currently available 
Medicare data.
    Several commenters raised concerns about the inherent limitations 
associated with the use of claims data for research purposes and 
requested that we acknowledge these limitations. In the following 
sections, we address all of these comments.

A. General Provisions

1. Statutory Basis
    On December 8, 2003, the Congress enacted the Medicare Prescription 
Drug, Improvement, and Modernization Act of 2003 (MMA) (Pub. L. 108-
173). Title I of the MMA amended the Act to establish a new voluntary 
prescription drug benefit program, Medicare Part D. As we stated in the 
preamble to the January 28, 2005 final rule (70 FR 4197) implementing 
the new prescription drug benefit, we believe that the addition of 
outpatient prescription drug coverage to the Medicare program is the 
most significant change to the Medicare program since its inception in 
1965.
    Unlike Parts A and B of the Medicare program, where Medicare acts 
as the payer and insurer and generally pays for items and services on a 
fee-for-service basis, the prescription drug benefit is based on a 
private market model. Under this model, CMS contracts with private 
entities--prescription drug plan (PDP) sponsors, Medicare Advantage 
(MA) organizations, as well as other types of Medicare health 
organizations--who then act as the payers and insurers for prescription 
drug benefits. These private entities are generally referred to as 
``Part D sponsors'' in our rules. Section 1860D-12 of the Act contains 
the majority of provisions governing the contracts CMS enters into with 
the Part D sponsors. That section, entitled, ``Requirements for and 
contracts with prescription drug plan (PDP) sponsors,'' incorporates by 
reference many of the contract requirements that previously were 
applicable to Medicare Advantage organizations.
    One of the incorporated provisions at section 1860D-12(b)(3)(D) of 
the Act, is section 1857(e)(1) of the Act, which provides broad 
authority for the Secretary to add terms to the contracts with Part D 
sponsors, including terms that require the sponsor to provide the 
Secretary ``with such information * * * as the Secretary may find 
necessary and appropriate.'' We believe that the broad authority of 
section 1860D-12(b)(3)(D) of the Act authorizes us to collect most of 
the information we currently collect to properly pay sponsors under the 
statute. However, section 1860D-15 of the Act contains provisions that 
might be viewed as limiting such collection. Therefore, we engaged in 
this rulemaking in order to resolve the statutory ambiguity, as well as 
to implement the broad authority of section 1860D-12(b)(3)(D) of the 
Act.
    Most of the payment provisions with respect to Part D sponsors are 
found in section 1860D-15 of the Act.\1\ Subsections (d) and (f) of 
section 1860D-15 of the Act authorize the Secretary to collect any 
information he needs to carry out that section. However, those 
subsections also state that ``information disclosed or obtained under 
[section 1860D-15 of the Act] may be used by officers, employees, and 
contractors of the Department of Health and Human Services only for the 
purposes of, and to the extent necessary in, carrying out [section 
1860D-15 of the Act].'' (Sections 1860D-15(d)(2)(B) and (f)(2) of the 
Act).
---------------------------------------------------------------------------

    \1\ We note that there are other provisions outside of section 
1860D-15 of the Act that also contain payment provisions. For 
example, section 1860D-14 of the Act discusses how CMS pays the low-
income subsidy.
---------------------------------------------------------------------------

    In the January 28, 2005 Medicare prescription drug benefit final 
rule (70 FR 4399), we stated that the section 1860D-15 of the Act 
restriction applies only in cases where section 1860D-15 of the Act is 
the authority for collecting the information. When information is 
collected under an independent authority (even if the collected 
information duplicates the data collected under section 1860D-15 of the 
Act) the restrictions under 1860D-15 of the Act would not apply. In the 
January 28, 2005 final rule (70 FR 4399), we noted that because quality 
improvement organizations (QIOs) have independent authority to collect 
Part D claims data in order to evaluate the quality of services 
provided by Part D sponsors, QIOs would not be barred from collecting 
such data despite the restrictions of section 1860D-15 of the Act. We 
refer readers to the October 18, 2006 proposed rule for the exact 
citation to the discussion in the January 28, 2005 final rule (71 FR 
61447). Similar to the statutory provisions authorizing QIOs to collect 
the information they need to perform their statutory duties, section 
1860D-12(b)(3)(D) of the Act recognizes that the Secretary will need to 
collect a broad array of data in order to properly carry out his 
responsibilities as head of the Department of Health and Human Services 
(DHHS). Thus, if the Secretary determines it is necessary and 
appropriate under section 1860D-12 of the Act for him to collect Part D 
claims data in order to carry out responsibilities outside section 
1860D-15 of the Act, then section 1860D-15 of the Act would not serve 
as an impediment to such collections.
    As stated in the October 18, 2006 proposed rule, we also believe 
that language in sections 1860D-12(b)(3)(D) and 1857(e)(1) of the Act 
indicating that the authority to collect information exists only 
``except as otherwise provided,'' and in a manner that is ``not 
inconsistent with this Part,'' would not serve as a hindrance to the 
independent collection of Part D claims data, since on its face, 
section 1860D-15 of the Act restricts use of information only when 
collected under that authority.
    As we stated in the proposed rule, the Congress most likely 
included the broad grant of authority in section 1860D-15 of the Act in 
order to ensure that the Secretary, without engaging in any rulemaking, 
would have the legislative authority to collect any necessary data in 
order to pay Part D sponsors correctly. However, we do not believe that 
the Congress intended to restrict the Secretary when the Secretary 
otherwise has independent authority to collect identical information to 
that collected under section 1860D-15 of the Act. Rather, we noted that 
the Secretary will need to evaluate Part D claims information in order 
to determine how access to Part D drug benefits affects beneficiary 
utilization of services under Parts A and B of the Medicare program.

[[Page 30666]]

Specifically, when Congress enacted the MMA, one of the stated reasons 
was to ensure that ``by lowering the cost of critical prescription 
drugs, seniors will better be able to manage their health care, and 
ultimately live longer, healthier lives.'' (Press Release, House Ways 
and Means Committee, Seniors Wait for Affordable Rx Drugs Comes to an 
End. President Bush Signs Historic Medicare Bill into Law (December 8, 
2003) (available at http://waysandmeans.house.gov/news.asp )). In order 
to determine whether lowering the costs of prescription drugs actually 
reduces health expenditures or improves health outcomes for 
beneficiaries, the Secretary will need to match individual level Parts 
A and B data with Part D claims data. In this way, the Secretary will 
be able to evaluate the effectiveness and efficiency of the Part D 
benefit and report to the Congress and others on the progress of the 
program.
    We are required to report to the Congress regarding whether 
mandated disease management demonstrations are budget neutral and 
whether beneficiaries in these demonstrations are on the appropriate 
medications. As we stated in the preamble of the proposed rule we may 
also need to make reports under the Part D program, for example, the 
publication of statistics detailing aggregate Medicare and beneficiary 
spending by class of drug, average number of drugs used by 
beneficiaries, total Medicare program spending, and other similar 
statistics. In order to derive such statistics, we would need to use 
Part D claims data. In the proposed rule, as well as in this final 
rule, we outlined a wide variety of situations in which it will be 
``necessary and appropriate'' for CMS to evaluate the same information 
collected under section 1860D-15 of the Act, even though such 
information would not be used to implement section 1860D-15 of the Act. 
In these situations, we believe the clear language of section 1860D-
12(b)(3)(D) of the Act provides the authority to collect the necessary 
information, and nothing about such collection will be inconsistent or 
in conflict with any other part of the statute.
    In addition, as discussed in this preamble, we are adding section 
1106 of the Act as a statutory basis for this final rule, as that 
section authorizes release of data by the agency through regulation.
    Comment: Some commenters stated that the proposed rule was 
inconsistent with the statute. Commenters also asserted that the 
collection is neither necessary nor appropriate, and some contended 
that the rule would improperly allow the release of proprietary data.
    Response: We refer readers to our discussion of the statutory basis 
in both the proposed rule (71 FR 61446) and in section II.A.1. of this 
final rule. As noted in the proposed rule, section 1860D-12(b)(3)(D) of 
the Act (and its incorporation of section 1857(e)(1)) of the Act 
provide broad authority to the Secretary to require Part D sponsors to 
provide the Secretary with ``such information as the Secretary may find 
necessary and appropriate.'' In addition, sections 1860D-15(d)(2)(B) 
and (f)(2) of the Act, by their own terms, restrict information only 
when ``disclosed or obtained under the provisions of [section 1860D-15 
of the Act].'' Thus, we continue to believe that when information is 
collected through a statutory authority independent of section 1860D-15 
(such as in the case of QIOs, who have independent authority to collect 
data) the restrictions of section 1860D-15 of the Act would not apply, 
and nothing about the collection or use of the claims data would create 
an inconsistency or conflict in the statute.
    We also believe the collection of claims data under section 1860D-
12 of the Act is both necessary and appropriate for the reasons 
discussed in the proposed rule and in this final rule. For example, the 
collection of such claims data will permit the Secretary to conduct 
high level, internal analyses of the Part D benefit, such as which 
drugs are commonly used by the Medicare population, the utilization of 
generic drugs in the Part D benefit, the effect of benefit design on 
catastrophic costs (costs for which reinsurance is available), the 
number of individuals who entered the catastrophic phase of the 
benefit, and many more types of analysis. Similarly, the Secretary will 
have the opportunity to crosswalk Part D claims data to Parts A and B 
data in order to analyze the effect of access to prescription drugs on 
utilization under hospital and supplementary medical insurance.
    We know that one of the stated reasons for the drug benefit was to 
modernize Medicare and ensure that beneficiaries were not enduring 
unnecessary hospitalizations due to failure to access preventive 
prescription drug regimens. At the time the prescription drug benefit 
was being enacted into law, then-chairman of the Senate Finance 
Committee, Senator Charles Grassley, stated:

    [T]his bill is about enhancing quality of life * * *. Today, the 
practice of medicine--and a lot of the thanks can go to prescription 
drugs--is to keep people out of hospitals and out of operating 
rooms. So people who cannot afford drugs, who go to the doctor very 
sick, are going to not only end up in a place they do not want to 
go, because people would rather not go to hospitals, rather not go 
to operating rooms. It is going to save our programs a lot of money, 
both private and public payment programs, for doctors and hospitals, 
when we can have people go into programs where they can get 
prescription drugs and keep their health up so they do not go to the 
hospital.
    (Medicare Prescription Drug, Improvement, and Modernization Act 
of 2003--Conference Report, 149 Cong. Rec. S15882-03, *S15883 and 
S15884 (November, 25, 2003)).

    Access to Parts A, B, and D claims data will allow the Secretary to 
analyze the prescription drug utilization of chronically ill patients 
over time, and determine whether increases in prescription drug 
utilization do, in fact, result in fewer hospitalizations. This is the 
type of analysis we believe the Congress expected the Secretary to 
engage in, and such analysis is both necessary and appropriate under 
the law.
    Finally, in response to concerns about releasing proprietary data 
to external entities as a result of this rulemaking, we note that data 
which could affect Medicare program spending, such as rebates, bids, 
reinsurance, and risk-sharing data, are not part of this rulemaking. In 
addition, as discussed later in this preamble, this rulemaking places 
certain limitations on data when released outside of CMS. We believe 
that it is in the interest of public health to share information 
collected under the regulations promulgated by this rule with entities 
outside of CMS for legitimate research, or in cases of other 
governmental agencies, for purposes consistent with their mission. 
Through the application of our ``minimum data necessary policy'', with 
some additional restrictions to protect beneficiary confidentiality and 
commercially sensitive data of Part D sponsors, and our data sharing 
procedures (which ensure the agency's compliance with the Health 
Insurance Portability and Accountability Act of 1996 (HIPAA), the 
Privacy Act of 1974, and other applicable laws), we will limit the use 
and disclosure of Part D claims data to ensure that the data are only 
used or disclosed as permitted or required by applicable law, and not 
inappropriately disclosed in a manner which could undermine the 
competitive nature of the Part D program.
    Comment: One commenter requested that CMS postpone implementation 
of this regulation until the Congress clarifies CMS's statutory 
authority and that CMS answer certain questions in a second posting for 
comment.

[[Page 30667]]

    Response: We believe we have the authority to collect Part D claims 
data under sections 1860D-12 and 1860D-15 of the Act, and to disclose 
Part D claims data collected under section 1860D-12 of the Act, in 
accordance with section 1106 of the Act. This final rule is 
sufficiently related to the proposals in the proposed rule, which were 
the subject of vigorous review and comment by the public, and we are 
not posting the proposal for a second round of comments.
    Comment: One commenter questioned why we were equating collecting 
data with accessing data.
    Response: As stated in both the proposed rule and this final rule, 
in order to ensure that Part D sponsors are not required to submit a 
second set of the same data already collected under section 1860D-15, 
we would collect the data that are the subject of this final rule by 
extracting them from Part D claims data already collected for payment 
purposes. This is the same approach we used when we discussed QIO 
access to data in the January 28, 2005 Part D final rule (70 FR 4399), 
where we stated that ``to the extent QIOs need access to data from the 
transactions between pharmacies and Part D sponsors, these data could 
be extracted from the claims data submitted to us''. Thus, in the 
preamble to this final rule, as in the preamble to the proposed rule 
(71 FR 61447), we may refer to ``accessing'' rather than ``collecting'' 
Part D data.
2. Information To Be Collected
    In the proposed rule, we proposed to independently collect the same 
claims information collected under section 1860D-15 of the Act under 
the authority of section 1860D-12(b)(3)(D) of the Act. The Part D 
claims data for 2006 and 2007 includes 37 data elements. We referred 
readers to the Prescription Drug Event data instructions which can be 
accessed at http://www.cms.hhs.gov/DrugCoverageClaimsData/01_PDEGuidance.asp#TopOfPage for a full description of this information.
    These instructions define each data element and its specific 
potential use for CMS's payment process. Generally stated, these data 
elements include the following:
     Identification of the Part D sponsor and Part D plan 
through contract number and plan benefit package identification number.
     Health insurance claim number, which identifies the 
particular beneficiary receiving the prescription.
     Patient date of birth and gender.
     Date of service.
     Date paid by the plan.
     Identification of pharmacy where the prescription was 
filled.
     Identification of prescribing health care professional.
     Identification of dispensed product using national drug 
code (NDC) number.
     Indication of whether drug was compounded or mixed.
     Indication of prescriber's instruction regarding 
substitution of generic equivalents or order to ``dispense as 
written.''
     Quantity dispensed (for example, number of tablets, grams, 
milliliters, or other unit).
     Days supply.
     Fill number.
     Dispensing status and whether the full quantity is 
dispensed at one time, or the quantity is partially filled.
     Identification of coverage status, such as whether the 
product dispensed is covered under the plan benefit package or under 
Part D or both. This code also identifies whether the drug is being 
covered as part of a Part D supplemental benefit.
     Indication of whether unique pricing rules apply, for 
example because of an out-of-network or Medicare as Secondary Payer 
services.
     Indication of whether beneficiary has reached the annual 
out-of-pocket threshold, which triggers reduced beneficiary cost-
sharing and reinsurance subsidy.
     Ingredient cost of the product dispensed.
     Dispensing fee paid to pharmacy.
     Sales tax.
     For covered Part D drugs, the amount of gross drug costs 
that are both below and above the annual out-of-pocket threshold.
     Amount paid by patient and not reimbursed by a third party 
(such as copayments, coinsurance, or deductibles).
     Amount of third party payment that would count toward a 
beneficiary's true out-of-pocket (TrOOP) costs in meeting the annual 
out-of-pocket threshold, such as payments on behalf of a beneficiary by 
a qualifying State Pharmaceutical Assistance Program (SPAP).
     Low income cost sharing subsidy amount (if any).
     Reduction in patient liability due to non-TrOOP-eligible 
payers paying on behalf of the beneficiary. This would exclude payers 
whose payments count toward a beneficiary's true out of pocket costs, 
such as SPAPs.
     Amounts paid by the plan for basic prescription drug 
coverage and amounts paid by plan for benefits beyond basic 
prescription drug coverage.
    In 2008, the number of elements collected in the Part D claims data 
was expanded from 37 to 39. Specifically, we added additional elements 
to reflect the estimated rebate amount applied to the point-of-sale 
price and the vaccine administration fee. Because these elements were 
added for 2008, they were not addressed in the October 18, 2006 
proposed rule. Furthermore, in the October 2006 proposed rule (71 FR 
61447), we did not explicitly discuss how we would respond to future 
changes in the elements collected as part of the claim. Rather, the 
proposed rule included only a discussion of the 37 elements that then 
comprised the Part D claim and proposed that we would collect these 37 
elements under section 1860D-12(b)(3)(D) of the Act. As a result, 
interested parties had an opportunity to comment only upon our proposal 
to collect the original 37 elements of the Part D claim under section 
1860D-12(b)(3)(D) of the Act, and there has not been any similar 
opportunity for interested parties to submit comments on whether the 
two new elements should also be collected under section 1860D-
12(b)(3)(D) of the Act, such that they may also be used for non-
payment-related purposes. Accordingly, we will not be collecting these 
two data elements under section 1860-12(b)(3)(D) of the Act at this 
time. We are finalizing a regulation establishing our authority to 
collect under section 1860D-12(b)(3)(D) of the Act only those 37 data 
elements that were part of the prescription drug event (PDE) record in 
2006. Data regarding these 37 elements may be used for both payment-
related and nonpayment-related purposes. As discussed later in this 
preamble, such use will be subject to our minimum necessary data 
policy, our data sharing procedures, and the encryption of certain 
identifiers and aggregation of cost data to protect beneficiary 
confidentiality and commercially sensitive data of Part D sponsors. 
Because data regarding the 38th and 39th elements will continue to be 
collected only under section 1860D-15(d)(2) and (f)(1) of the Act, 
consistent with Sec.  423.322(b), these data may be used only for 
payment-related purposes.
    We note that this final rule does not extend to rebate or other 
price concession data, otherwise known as ``direct or indirect 
remuneration'' or ``DIR'', with the exception of DIR that may be 
reflected in the negotiated price paid for a drug at the point of sale. 
Again, the collection of Part D data under the authority of section 
1860D-12 of the Act in accordance with this final rule, is limited to 
the original 37 data elements collected as part of the Part D claims 
data. We have clarified this in

[[Page 30668]]

response to comments and in the regulatory text.
    Comment: Commenters were generally supportive of CMS's proposal to 
access Part D claims data for research and non-research purposes, and 
agreed that the data will provide valuable information and be essential 
in the evaluation of the Part D benefit. Several commenters requested 
additional elements be added to the original 37 PDE elements outlined 
in the proposed rule.
    Response: We agree that the PDE data elements we now collect will 
provide a valuable tool for evaluating the Part D program, and 
appreciate the suggestions to add other elements for collection. This 
final rule is first and foremost a clarification of the statutory 
authority that allows us to collect the original 37 PDE elements 
outlined in the proposed rule and this final rule and to access them 
for purposes other than payment. Since these data are already being 
collected under the Part D program, we would access the already-
collected data and make them available for research and non-research 
purposes, without undue burden to Part D sponsors or beneficiaries.
    As discussed above, in 2008, the number of PDE data elements was 
expanded to 39. In future years, we may revise our guidance on PDE 
Reporting to include additional elements on the claim beyond the 
elements presently collected. Through separate rulemaking, we will 
address whether we intend to collect any of these additional elements 
under our authority in section 1860D-12(b)(3)(D) of the Act.
    Comment: Several commenters noted that the proposed rule relates to 
drug claims and related information and asked for clarification as to 
what is meant by this phrase. A few commenters noted that the presence 
of this phrase in the proposed regulatory text suggests that CMS may be 
contemplating using and sharing rebate and other discount and pricing 
concession data.
    Response: Rebate and other price concession data are not the 
subject of this final rule. This rulemaking applies to Part D claims 
data only, and is limited to the original 37 elements reported on the 
PDE. To further clarify this point we are amending proposed Sec.  
423.505(f)(3) to delete the applicable reference to ``related 
information.''
    Comment: Several commenters expressed concern about access to cost 
and pricing data. Several commenters noted that pricing data contained 
on the Part D claim are not an accurate reflection of the actual costs 
to plans. These commenters also requested clarification that the 
information we are proposing to collect and disclose relate only to 
Part D claims data, and not to competitively sensitive financial data 
regarding rebates, discounts or other negotiated price concessions. The 
commenters expressed a concern that release of competitively sensitive 
data could undermine the competitive bid process. They assert that 
plans will be able to adjust their bids on the basis of knowledge of 
each others' data, resulting in higher drug costs for all.
    Response: We share the commenters concerns about the need to 
protect the sensitive data under the Part D program. Because the 
Medicare drug benefit is based on a competitive business model, to 
release commercially or financially sensitive data to the public could 
negatively impact Part D sponsors' ability to negotiate for better 
prices, and ultimately affect the ability of sponsors to hold down 
prices for beneficiaries and taxpayers. Therefore, we have adopted a 
number of protections to mitigate these concerns.
    First, we have clarified that this final rule applies only to the 
37 original elements of Part D claims data and not to rebate and other 
price concessions data. As discussed above, to the extent that the PDE 
record was amended in 2008 to include data on estimated rebates applied 
at the point of sale, we have clarified it in the regulation that we 
will not be collecting this information under that authority. In 
addition, we note that plan-specific bid information is not included on 
the claim, and therefore, would not be the subject of this rulemaking.
    Second, with respect to our disclosures of information collected 
under this rulemaking to external entities, we have developed an 
approach to minimize the risk of unauthorized disclosure of beneficiary 
identifiable information, as well as the use of commercially sensitive 
data of Part D sponsors. Similar to the process used under Parts A and 
B program:
     We will require research using beneficiary identifiable 
data to be conducted by an experienced entity at a reputable 
organization, with an appropriate research design, and with assurances 
to protect beneficiary confidentiality. Research is to be made 
available to the public and identifiable data is not released for 
commercial purposes.
     We will only release beneficiary identifiable data for 
research purposes if the CMS privacy board approves the data release 
and then, will only release the minimum data necessary for the study.
     Requesters who receive identifiers to link to another 
dataset will be required to re-encrypt beneficiary identifiers, after 
data linkage, to minimize the risk of accidental disclosure.
     Requesters will sign a data use agreement which carries 
penalties for misuse or intentional release of beneficiary identifiable 
information.
    In addition to these protections of beneficiary identifiable 
information, we plan to impose additional restrictions to further 
protect beneficiary confidentiality and plan commercially sensitive 
information. When releasing data to external entities, we will restrict 
releases according to the following principles:
     Only the minimum necessary elements from the PDE will be 
released for a project. In accordance with this principle, cost data 
will not be released unless necessary for the project.
     Drug cost elements (that is, ingredient cost, dispensing 
fee, and sales tax) will be aggregated.
     Beneficiary identifiers, pharmacy identifiers and 
prescriber identifiers will be encrypted where not needed to link to 
other datasets. Additionally, an element representing the internal 
prescription service reference number assigned by pharmacies will not 
be released so as to not indirectly reveal pharmacy identifiers.
     Plan identifiers will always be encrypted for external 
entities. We note that the internal plan identification numbers on the 
claim would also not be available to external entities as these 
represent reference numbers assigned by the plan at the time a drug is 
dispensed and release of such numbers could lead to a de facto 
identification of the plan. We also note that when we state in this 
preamble that an identifier will be encrypted, this means that it will 
be replaced with a non-identifiable number or code such that there is a 
low probability of assigning any meaning to the replacement number or 
code. Unless otherwise noted, encryption will occur without any 
decryption, and we would not provide a key that allows for an encrypted 
identifier to be converted back into its original form. We believe 
these restrictions will protect both the commercially sensitive data of 
Part D plans, such as the plan identifiers, pharmacy identifiers, 
prescriber identifiers and cost elements, as well as the beneficiary 
identifiable data included on the claim. Similar protections for both 
beneficiary identifiable information as well as commercially sensitive 
data of Part D sponsors will be in place for releases to governmental 
entities as well including

[[Page 30669]]

States, Congress and other executive branch agencies. For both States 
and non-HHS executive branch agencies, the drug cost elements on the 
claim (ingredient cost, dispensing fee, and sales tax) will be 
aggregated together, and will not be available in a disaggregated 
format, except that, upon request, CMS will exclude sales tax from the 
aggregation at the individual claim level if necessary for the project. 
We believe this aggregation will serve to ensure that some of the most 
confidential data on the claim--the separate costs paid by Part D 
sponsors for ingredient cost or dispensing fee--will not be vulnerable 
to any unauthorized release. However, because these government agencies 
may need other data on the claim in order to coordinate treatment of 
beneficiaries or further study care received by individual 
beneficiaries, we will make the beneficiary, plan, pharmacy, and 
prescriber identifiers available to these entities where needed. For 
example, as discussed later in this preamble, States have specifically 
requested claims data for beneficiaries dually eligible for Medicaid 
and Medicare. By understanding the care received by these 
beneficiaries, the State Medicaid agencies may be able to better 
coordinate the medical costs they reimburse under Medicaid with the 
drug regimens being reimbursed under the Medicare Part D program. In 
coordinating care, these State agencies may need to understand which 
plan a beneficiary is enrolled in. Releases to Congressional oversight 
agencies are discussed in response to comment later in this preamble. 
We have included these restrictions in our amended regulations at Sec.  
423.505(m).
    The appendix to this rule also contains a CMS chart, explaining in 
more specific detail the restrictions relative to the available PDE 
elements for various parties. We will evaluate all requests for these 
data to ensure that any release is consistent with the restrictions 
contained in our regulations, and we will release only the minimum data 
that are necessary for the specific project. Additionally, as part of 
our data sharing procedures, we will ensure that any disclosure is for 
an appropriate purpose and does not undermine the competitive nature of 
the Part D program, such as a disclosure that would result in Part D 
sponsors being able to adjust their plan bids on the basis of knowledge 
of each others' data.
    Finally, while we agree with commenters that cost data on the Part 
D claim may not reflect the actual costs to plans, such data does 
reflect costs incurred at point-of-sale, and may be of use to CMS, 
other governmental entities, and other external entities for projects 
unrelated to a plan's total costs.
    Comment: One commenter asked that CMS appropriately use and 
differentiate between the terms ``sex'' and ``gender'' in its data 
collection process.
    Response: The Patient Gender Code field in the Part D claim is 
defined by the National Council of Prescription Drug Programs (NCPDP). 
We have found it helpful in working with the industry and other 
stakeholders to rely on the NCPDP industry standard whenever possible. 
The NCPDP data dictionary defines ``Gender Code'' under definition of 
field, ``For eligibility, and identifying the gender of the member.'' 
Values are: M=Male, F=Female, and U=Unknown.

B. Purpose of CMS Collecting Information

    In the proposed rule, we outlined our intended use of Part D claims 
data for a wide variety of statutory and other purposes including--
     Reporting to the Congress and the public on the overall 
statistics associated with the operation of the Medicare prescription 
drug benefit;
     Conducting evaluations of the Medicare program;
     Making legislative proposals with respect to the programs 
we administer, including the Medicare, Medicaid, and the State 
Children's Health Insurance Program; and
     Conducting demonstration projects and making 
recommendations for improving the economy, efficiency, or effectiveness 
of the Medicare program.
    In the final rule, we continue to believe such uses are necessary 
and appropriate. In addition, as discussed below and later in this 
preamble, we also intend to use these data for ``other studies 
addressing public health questions,'' ``pilot projects,'' ``supporting 
quality improvement and performance measurement activities,'' and 
``populating personal health records,'' and have added these purposes 
to the list in Sec.  423.505(f)(3).
    Comment: Many commenters believe analyses of Part D claims data are 
necessary for CMS to administer the Medicare program, and for planning, 
evaluation, and policy development. Examples of program research and 
evaluation uses suggested by commenters include--
     Assuring that Part D has not promoted adverse selection 
into certain health plans with less generous medication coverage;
     Examining the effects of drug coverage and cost 
containment on Medicare spending and the health of vulnerable elderly 
and disabled persons;
     Measuring the success of prescription drug plans in 
encouraging the use of generic medicines;
     Examining the transition effects of moving dual eligibles 
from Medicaid programs to Part D;
     Analyzing the effects of a coverage gap on drug 
utilization and spending;
     Determining the impact of Part D coverage on non-
pharmaceutical treatments and services use;
     Evaluating the effect of changing copayments, copay 
structures, and coverage limits on beneficiary drug choices and 
compliance with drug regimens;
     Assessing the extent to which risk adjustment methodology 
influences enrollment dynamics;
     Assessing the impact of adding a prescription drug benefit 
on health outcomes of beneficiaries;
     Researching the extent to which disparities in care (based 
on race, socioeconomic status, rural residence, etc.) might be affected 
by Part D; and
     Understanding the impact of Part D on related public 
programs, such as the State Children's Health Insurance Program 
(SCHIP), SPAPs, Medicaid, and the VA.
    Commenters also noted that being able to explore how Part D 
functions on its own and in relation to other parts of the Medicare 
program is essential to guiding future policy decisions. They further 
assert that use of Part D claims data is critical to CMS's credibility 
and should be considered as part of the Secretary's value-based health 
care purchasing initiative. Without access to Part D claims data for 
research and other purposes, CMS will limit its ability to monitor 
expenditures for the new program, to study the impact of the program on 
public health, and to respond to Congressional requests for 
information.
    Response: We agree with the many comments that Part D claims data 
will be essential to us for reporting, conducting program evaluations 
and demonstrations, research analyses, and other public health 
functions. We also agree that research uses of these data should help 
promote and protect the health and well-being of Medicare 
beneficiaries. While we believe these uses were implied in the 
regulatory text set forth in the proposed rule, we are expanding the 
list of necessary and appropriate purposes for which data will be 
collected in this final rule to address public health functions 
specifically.
    Comment: Commenters expressed widespread support for using Part D

[[Page 30670]]

claims data to improve our knowledge base on medication adherence and 
other aspects of pharmacotherapy among the elderly and disabled. Some 
specific suggested uses of Part D claims data for this purpose include 
the following:
     Describing current medication use among the elderly and 
disabled and examining trends, specifically enhancing our awareness of 
poly-pharmacy, off-label uses, avoidance of contraindicated drugs and 
dangerous drug-drug interactions.
     Examining the extent to which Medicare beneficiaries 
receive medicines according to evidence based guidelines.
     Assessing whether beneficiaries are adhering to prescribed 
therapy, and if not, the clinical and economic impact of nonadherence.
     Testing new interventions to improve medication 
prescribing and adherence.
     Evaluating the impact of medication therapy management 
programs mandated under the new Medicare prescription drug benefit.
    Response: We consider examining medication use, inappropriate use, 
and factors influencing medication adherence in the Medicare population 
to be crucial aspects of Part D program monitoring and evaluation, and 
public health. As noted by commenters, the Congress mandated that we 
examine best practices of medication therapy management, and Part D 
claims data are critical for our being able to complete that study.
    Comment: A few commenters noted that sharing of research results is 
critical to CMS credibility and should be considered part of the 
transparency initiative.
    Response: We recognize Part D claims data research, and any 
subsequent results, are critical to evaluating multiple aspects of the 
Medicare Prescription Drug program. Many quality measures developed by 
the American Medical Association Physician Consortium and National 
Committee for Quality Assurance, and subsequently adopted by Ambulatory 
Care Quality Alliance, and the Hospital Quality Alliance require Part D 
claims data to run the measures. All of the following quality measures 
involve Part D claims data: Drug Therapy for Lowering Cholesterol, 
Beta-Blocker Therapy within 7 days post myocardial infarction, and 
Beta-Blocker therapy at 6 months post myocardial infarction. These 
measures will be used by many of the Better Quality Information to 
Improve Care for Medicare Beneficiaries Project pilots, including the 
new local collaboratives being chartered under the Secretary's value-
based health care initiative to foster public reporting. All of this 
makes Part D claims data an integral part of our transparency efforts. 
Thus, in this final rule, we are clarifying our intent to use Part D 
data for these necessary and appropriate purposes by adding 
``supporting quality improvement and performance measurement 
activities'' as an explicit use of these data under Sec.  
423.505(f)(3).
    Comment: A commenter asserts that we did not adequately justify the 
use of Part D claims data by the Secretary for public reporting 
purposes, apart from its use to develop reports to the Congress, which 
may become publicly available records.
    Response: As we stated in the proposed rule, we believe it is 
appropriate and necessary for the Secretary to use Part D claims data 
for the purposes of reporting to the Congress on the effectiveness and 
performance of the prescription drug benefit--including reporting that 
is not related to payment. In addition, we may need Part D claims data 
to report to the public on aggregate statistics associated with the 
Part D program. Finally, the Secretary has determined that it is 
necessary and appropriate, under section 1860D-12 of the Act, that the 
public should have access to certain data, so that the public may 
monitor the progress of the Part D program and, in fact, perform 
research that will improve the health of, not only Medicare 
beneficiaries, but all Americans. This is why we have created Part D-
related public use files relating to plan benefits and formularies (for 
example, files such as geographic locator files, plan information 
files, formulary files, beneficiary cost files, pharmacy network files, 
and record layout files as described at http://www.cms.hhs.gov/NonIdentifiableDataFiles/09_PrescriptionDrugPlanFormularyandPharmacyNetworkFiles.asp.). We may also 
create additional public use files subsequent to the publication of 
this final rule.
    Comment: Several commenters suggested that the reporting of overall 
statistics and development of evaluations and/or legislative proposals 
can be achieved without CMS having to use or disclose the Part D 
sponsors' Part D claims data. The commenter suggested that CMS use 
information that is separately collected from the claim to develop 
statistics, noting however, that this information will not necessarily 
allow CMS to do every type of analysis described in the proposed rule. 
Additionally, CMS could partner with one or more sponsors to use their 
data, alone, or in combination, to do additional statistics and 
analysis.
    Response: Although we are willing to partner with plan sponsors as 
needed, we do not believe that voluntary cooperation by Part D sponsors 
would provide the kind of comprehensive data sets we need to perform 
the research, evaluations, reporting and other functions that are 
described this final rule. Voluntary agreements with plan sponsors 
would lead to an incomplete file of data. In addition, because we 
possess the authority under section 1860D-12(b)(3)(D) of the Act to 
collect Part D claims data, we do not believe an exclusive reliance on 
such voluntary agreements is necessary.
    Comment: A commenter noted that a recent Report to Congress 
recommended that the Secretary should have a process in place for the 
timely delivery of Part D data to congressional support agencies to 
enable them to report to the Congress on the drug benefit's impact on 
cost, quality, and access.
    Response: We agree that congressional support agencies should have 
timely access to appropriate Part D data. This final rule allows 
congressional oversight agencies access to all elements on the Part D 
claim in order to carry out their functions. Like other agencies 
outside of CMS, such congressional agencies would be subject to our 
minimum necessary policies and data sharing policies. Thus, we would 
release only the minimum amount of Part D claims information necessary 
to support given projects. In addition, as discussed later in this 
preamble, the Congressional Research Service has the authority to 
require data releases only when acting on behalf of a committee. Thus, 
that agency would be treated the same as a congressional oversight 
agency when acting on behalf of committee. Otherwise, it would be 
subject to the same restrictions that apply to external entities in our 
regulation.
    Comment: Several commenters requested that we establish specific, 
explicit procedures to ensure that if comparative effectiveness or 
safety research informs coverage or payment decisions for specific 
items and services (whether decisions are made by CMS or its agents 
under Parts A and B or by private plans under Part D), stakeholders 
have an opportunity to evaluate the evidentiary basis of proposed 
decisions and provide input.
    Response: Since our proposed rule did not address the development 
of national coverage or payment decisions, but rather our access to 
Part D claims data, we believe that our development of coverage or 
payment decisions is beyond the scope of this rulemaking.

[[Page 30671]]

We do note that section 1860D-4(b)(3) of the Act requires pharmacy and 
therapeutic committees to base clinical formulary decisions on the 
strength of the scientific evidence and standards of practice. We have 
issued further formulary guidance available at http://www.cms.hhs.gov/Pharmacy/07_Formulary%20Guidance.asp#TopOfPage.
    Comment: Some commenters noted potential uses for Part D claims 
data, linked with Parts A and B data, which extend beyond research into 
the actual provision of care, including disease management.
    Response: We believe the implementation of disease management 
programs and the evaluation of these programs could potentially be 
strengthened by the use of Part D claims data. However, we believe 
these data must be used with caution for these purposes since we 
collect Part D claims data only for Medicare Part D enrollees. We do 
not collect drug claims data for those beneficiaries who receive their 
drug insurance solely from other sources, such as employer or retiree 
sponsored health plans, the Veterans Health Administration, or TRICARE.
    Comment: Some commenters noted that Part D claims data can help 
improve Medicare's current basis of risk adjustment for plan payments.
    Response: Section 1860D-15(d)(2)(B) of the Act provides us 
authority to use Part D claims data for determining Medicare payments 
to prescription drug plan sponsors. This includes their use for 
refining our drug plan payment system. Thus, when claims data are used 
for risk adjustment they are collected under section 1860D-15 of the 
Act, and not under section 1860D-12 of the Act.
    Comment: A commenter recommended adding the phrase ``and pilot'' 
into the text of the Sec.  423.505(f)(3)(iv), so that the regulation 
would read ``The Part D plan sponsor agrees to submit to CMS * * * 
[d]ata included in drug claims submitted by Part D plan sponsors, as 
the Secretary deems necessary and appropriate for purposes including 
but not limited to * * * [(f)(3)(iv) c]onducting demonstration and 
pilot projects and making recommendations for improving the economy, 
efficiency, or effectiveness of the Medicare program.'' The commenter 
wants to ensure that Medicare Health Support Organizations are able to 
access Part D claims utilization data.
    Response: We agree that pilot projects, as appropriate, should have 
access to these data, as appropriate, and have added the phrase ``and 
pilot'' to Sec.  423.505(f)(3)(iv).
    Comment: Several commenters requested that the list of purposes for 
which the data would be used be expanded to include program integrity.
    Response: We agree that it is important that our program integrity 
components have access to necessary data in order to protect the 
program. The existing regulation at Sec.  423.322(b) already allows 
information collected under section 1860D-15 of the Act to be used in 
determinations of payments and payment-related oversight and program 
integrity activities. To the extent that program integrity activities 
may include investigations of issues that are not directly payment-
related, this rule will provide access to Part D claims data for these 
purposes.
    Comment: One commenter requested we clarify in the final rule that 
Part D claims data can be used by CMS to oversee and protect the 
program. Other commenters stated that we should clarify that Medicare 
Drug Integrity Contractors (MEDICs) can obtain Part D claims data where 
necessary to fully investigate complaints and fraudulent claims.
    Response: Our regulations already address use of payment data for 
payment-related oversight. We are constantly working with our MEDICs to 
determine the types of data to which they will have access. However, we 
believe our interactions with our contractors involve internal agency 
procedures, and are not the subject of this final rule.

C. Sharing Data With Entities Outside of CMS (Final Sec.  423.505(f)(3) 
and (l) Through (o))

    As stated in the October 18, 2006 proposed rule, in addition to 
collecting Part D claims data for use in administering the Medicare 
Part D program under the authority of section 1860D-12(b)(3)(D) of the 
Act, we also believe that it is in the interest of public health to 
share the information collected under that authority with entities 
outside of CMS. When information is collected under the authority of 
section 1860D-12(b)(3)(D) of the Act, we do not believe that the 
statutory language in section 1860D-15(d) and (f) of the Act (requiring 
the information collected under the authority of that section to be 
used only in implementing such section) would apply, since any 
collection would be effectuated outside of section 1860D-15 of the Act. 
Therefore, as we stated in the October 18, 2006 proposed rule, we 
proposed to add a new Sec.  423.505(f)(5) to the regulations (now Sec.  
423.505(l) and (m)) that would specify that we could use and share the 
Part D claims information we collect under Sec.  423.505(f)(3), without 
regard to any restriction included in Sec.  423.322(b). In response to 
comments, we clarify in this final rule that our regulation permitting 
release of Part D claims data to other government agencies and outside 
entities is authorized by section 1106 of the Act.
1. Other Government Agencies
    We stated in the proposed rule that the Department of Health and 
Human Services' (DHHS') public health agencies such as the National 
Institutes of Health (NIH), the Food and Drug Administration (FDA), and 
the Agency for Healthcare Research and Quality (AHRQ) have, or support, 
researchers that would need to use Medicare Part D prescription drug 
event data for studies, and other projects, to improve public health 
consistent with the missions of these agencies. We also stated that 
oversight agencies may need access to both aggregated and non-
aggregated claims data in order to conduct evaluations of the Part D 
program that are unrelated to payment and therefore not authorized 
under section 1860D-15 of the Act. In addition, agencies in the 
legislative branch, such as the GAO, MedPAC, and CBO, may need access 
to data in order to evaluate the program. We continue to believe this.
    We also continue to believe that other agencies within DHHS, such 
as the Centers for Disease Control and Prevention, the Health Resources 
and Services Administration, or the Office of the Assistant Secretary 
for Planning and Evaluation, may also need Part D claims data to 
perform evaluations or assess policies. However, we note specifically 
that OIG has independent authority to collect Part D claims data from 
Part D sponsors to perform its statutory duties in accordance with the 
Inspector General Act of 1978, as amended, 5 U.S.C. App. This final 
rule provides OIG an additional avenue for access to these data for 
both payment and nonpayment purposes.
    Given these necessities, we proposed to allow broad access for 
other Federal government executive branch agencies to our Part D claims 
data, linked to our other claims data files. As stated in the preamble 
of the proposed rule, other agencies generally would enter into a data 
sharing agreement, similar to what is used today. This would allow the 
sharing of event level cost data, protect the confidentiality of 
beneficiary information, and ensure that the use of Part D claims data 
serves a legitimate purpose. We also stated in the proposed rule that 
we would also ensure that any

[[Page 30672]]

system of records with respect to Part D claims data is updated to 
reflect the most current uses of such data.
    In the proposed rule, we requested comments that would help us in 
our efforts to improve knowledge relevant to the public health. 
Specifically, we requested guidance on how we can best serve the needs 
of other agencies through the sharing of information we collect under 
section 1860D-12(b)(3)(D) of the Act, while at the same time addressing 
the legitimate concerns of the public and of Part D plan sponsors that 
we appropriately guard against the potential misuse of data in ways 
that would undermine protections put in place to ensure confidentiality 
of beneficiary information, and the nondisclosure of proprietary data 
submitted by Part D plans.
    After considering the comments received, we will make Part D claims 
data available under a process that builds upon the practice that is 
currently in place today with respect to the release of Medicare Parts 
A and B data. Thus, we specify in this final rule that, of the data we 
collect under the authority of section 1860D-12 of the Act, only the 
minimum information necessary, subject, in certain cases, to encryption 
and aggregation of certain elements, will be shared with other Federal 
executive branch agencies, which would include contractors acting on 
their behalf, in accordance with section 1106 of the Act, based on data 
sharing procedures established by CMS and agreed to by the Federal 
executive branch agency requesting the data. The attached appendix, as 
well as our amended rules at Sec.  423.505(m), explain how in this 
final rule we would group the governmental entities outside of CMS that 
request access to the data collected under 1860D-12 of the Act. 
Agencies within HHS, as well as the Congressional oversight agencies 
(including CRS when acting on behalf of a committee) would receive only 
the elements of the PDEs on the claim that are minimally necessary for 
the applicable project. Plan, pharmacy, and prescriber identifiers 
would be encrypted unless necessary for the project. In addition, for 
States and non-HHS executive branches, the dispensing fee, ingredient 
cost and sales tax elements on the claim would be aggregated together 
prior to any release, except that, upon request, we will exclude sales 
tax from the aggregation at the individual claim level if necessary.
    Comment: One commenter objected to the use of the word 
``necessities,'' stating that it is not necessary to allow broad access 
to Part D claims data.
    Response: We continue to believe that it is both necessary and 
appropriate for the Secretary to collect the Part D claims data under 
section 1860D-12(b)(3)(D) of the Act in order to carry out his broad 
range of duties under the Act, including the duties that are listed at 
Sec.  423.505(f)(3). Once the Secretary collects the information for 
his own necessary and appropriate purposes, we do not believe that the 
external release of such information must be categorized as necessary 
in order for it to occur, as section 1860D-12(b)(3)(D) of the Act 
refers to the collection of, not the release of, data. Release of data 
will be authorized under section 1106 of the Act. In addition, any 
release will be intended for the benefit of the public health and 
welfare.
    Comment: Several commenters requested that the FDA play a central 
role in any use of Part D claims data for safety evaluations. Others 
requested that CMS issue a separate proposal to present CMS and FDA 
combined views on sharing of data for public comment. One commenter 
also contended that the FDA may not want to use Part D claims data 
because of alleged reliability problems and the fact that the FDA may 
have problems integrating the Part D claims data with its own 
databases. Finally, commenters requested that both agencies allow 
manufacturers to review the data and methods used for post-marketing 
surveillance.
    Response: We do not believe that the FDA's use of Part D claims 
data or how the claims data are used in safety evaluations is the 
subject of this proposed rule. However, we note that we plan to 
exchange Part D claims data with the FDA in accordance with applicable 
laws and our data sharing procedures, by entering into appropriate 
interagency agreements and data use agreements. Thus, our procedures 
for sharing data with the FDA will be the same as those developed for 
other government agencies.
    Comment: A commenter requested that the Congressional Research 
Service (CRS) be able to access the same level of data as oversight 
agencies, such as the Office of the Inspector General (OIG), the 
Government Accountability Office (GAO), the Congressional Budget Office 
(CBO), and the Medicare Payment Advisory Commission (MedPAC).
    Response: In the proposed rule we stated that the Congressional 
oversight agencies (GAO, MedPAC, and CBO) may require access to data in 
order to evaluate the Part D program (71 FR 61452). Although we did not 
define CRS as a Congressional Oversight entity, like GAO, it does have 
statutory authority to request data (see 2 U.S.C. 166(d)(1)), but only 
when it is doing so on behalf of a committee. Accordingly, we are 
specifying that CRS will be considered a congressional oversight agency 
when the CRS is acting on behalf of committee under 2 U.S.C. 166(d)(1). 
Our regulations at Sec.  423.505(m), as well as the attached appendix 
outline the data policies that would apply to congressional oversight 
agencies, including being subject to our minimum data necessary policy, 
our data sharing procedures, and applicable laws. For individually 
identifiable information or certain commercially or financially 
sensitive information, such as plan identifiers and cost information, 
these Congressional oversight agencies will be required to sign a Data 
Use Agreement (or provide assurances acceptable to CMS) to protect 
against disclosure of such data. When CRS is not acting as the agent of 
a committee, however, it does not have the same authority to request 
data from departments or agencies of the United States. Thus, we have 
specified that in these cases, CRS would be treated as an external 
entity, because the agency would essentially be performing research or 
analysis on behalf of an individual member of the congress. In 
addition, unlike States or other executive branch departments, the CRS 
should not need access to plan identifiers or other data on the claim 
in order to coordinate care on behalf of beneficiaries. Thus, we have 
specified that CRS will be restricted in the same manner as external 
researchers, and will not be treated similar to other executive branch 
agencies or States.
    Comment: A commenter asked CMS to allow for a process that permits 
access to Part D claims data in a highly organized way and enables 
external entities to replicate any results Federal agencies obtain 
using the data.
    Response: We believe that our approach to providing access to Part 
D claims data, which would follow a review of each request under our 
minimum necessary data policy with some additional encryption and 
aggregation restrictions based on type of requestor, balances the need 
for Part D data in order to conduct legitimate research with the needs 
to protect patient information and to preserve the competitive nature 
of the Part D program. Therefore, we will review legitimate research 
requests and decide whether to release Part D claims information, 
consistent with our regulation at Sec.  423.505(m), as well as the 
guidance provided in the appendix to this final rule. We expect that 
external entities may be able to replicate the results of Federal 
analyses for many research questions, such as those

[[Page 30673]]

relating to the utilization of specific drugs or classes of 
medications, comparative effectiveness or safety research.
    Comment: A few commenters asked that all applicable government 
agencies have broad access to the data in a timely fashion without 
having to enter into numerous data use agreements (DUA).
    Response: As illustrated in our regulation Sec.  423.505(m), as 
well as in the appendix to this final rule, non DHHS entities will have 
access to the minimum Part D claims data necessary for a given project, 
except that certain elements may be encrypted or aggregated. In the 
event of a backlog of requests for Part D data under these rules, we 
plan to give government agencies first preference in the review 
process, and to require such agencies to abide by our data sharing 
policies, which generally require a data use agreement. We have 
modified or streamlined the data sharing process in the case of certain 
Federal law enforcement or oversight entities. For example, we have 
streamlined the DUA process for the Department of Justice (DOJ). DOJ 
provides a letter for each request for data, which CMS tracks and 
monitors.
2. External Entities
    As stated in the preamble of the proposed rule, external entities, 
such as researchers based in universities, regularly request and 
analyze Medicare data for their research studies, many of which are 
designed to address questions of clinical importance and policy 
relevance. We continue to believe researchers studying a broad range of 
topics need access to Part D claims linked to Parts A and B claims 
data. As stated in the preamble of the proposed rule, analyses of Parts 
A and B claims have contributed to significant improvements in the 
public health, have been critical in assessing the quality and costs of 
care for patients in the Medicare program, and have, in many cases, 
spurred other types of research. As such, we continue to believe that a 
data source that includes Parts A and B claims as well as their 
attendant Part D claims could be used in a similarly constructive 
manner, such that greater knowledge on a range of topics, both clinical 
and economic, would be generated. This knowledge is expected to 
contribute positively to the evaluation and functioning of the Medicare 
program, and to improve the clinical care of beneficiaries.
    Also, as stated in the preamble of the proposed rule, we will 
specifically address the needs of a segment of external entities as 
part of our implementation of section 723 of the MMA, which requires 
the Secretary to develop a plan to ``improve the quality of care and 
reduce the cost of care for chronically ill Medicare beneficiaries.'' 
The Congress specifically stated that the plan should provide for the 
collection of data in a data warehouse (under section 723(b)(3) of the 
MMA). Within the parameters of this regulation, we will implement 
section 723 of the MMA by populating a chronic care condition data 
warehouse (CCW) which will be accessible by private researchers in 
order for such researchers to conduct studies related to improving 
quality and reducing costs of care for chronically ill Medicare 
beneficiaries.
    In addition to the section 723 of the MMA data warehouse, we stated 
in the proposed rule that we are planning to make Medicare Part D 
claims data linked to other Medicare claims files available to external 
entities on the same terms as other Medicare Parts A and B data are 
released today, with appropriate protections for beneficiary 
confidentiality. We requested comments on the proposed use of the data 
for research purposes that would help us in our efforts to improve 
knowledge relevant to the public's health, as well as comments on 
whether we should consider additional regulatory limitations for 
external entities beyond our existing data use agreement protocols in 
order to further guard against the potential misuse of data for non-
research purposes, commercial purposes, or to ensure that proprietary 
plan data or confidential beneficiary data are not released.
    As explained in response to comments, we continue to maintain the 
discretion to release the 37 collected PDE elements for legitimate 
research purposes, subject to encryption of certain identifiers and 
aggregation of cost data to protect beneficiary confidentiality and 
commercially sensitive data of Part D sponsors. (These restrictions are 
outlined in our regulations at Sec.  423.505(m) as well as in the 
appendix attached to this rule.) Furthermore, we also believe Part D 
claims data are necessary for use in personal health records and to 
ensure the public will be able to access the results of quality 
measurement and performance initiatives as discussed in the ``Purpose 
of CMS Collecting Information'' section of this preamble. We will 
release only the minimum information necessary for a given project. In 
addition, data will be disseminated in accordance with applicable laws 
via our established data sharing procedures. Thus, the requestor of 
data must agree to abide by the restrictions established by our data 
sharing procedures in order to receive access to Part D claims data. We 
will ensure that our system of records for Part D claims data would 
permit the uses of the data described in this final rule.
    Comment: In general, the importance of Part D claims data for 
improving aspects of public health was a recurring theme among many of 
the comments we received. Commenters noted the lack of a comprehensive 
source of prescription medication data as one of the greatest 
challenges to conducting meaningful research in the elderly. They noted 
that Part D claims data will be vital for enhancing disease 
surveillance, identifying rare complications of drug therapy, and 
improving knowledge about the effectiveness and safety of drugs. 
Several commenters underscored that knowledge based on selected aspects 
of pharmacotherapy in the elderly or disabled population is limited. 
They point out that the very old, patients with multiple chronic 
conditions, and those taking multiple medications are routinely 
excluded from clinical trials, and assert that research based on Part D 
claims data would provide a valuable supplement to the FDA's current 
post-marketing surveillance system.
    Other themes raised by commenters centered on the current 
fragmentation of our health care information and the lack of 
information on drug treatment in the elderly. These commenters 
suggested that analyses of Part D claims data linked with Parts A and B 
data could provide a comprehensive picture of disease treatment, help 
guard against siloed policy analyses, and support a broad, disease-
centered research agenda that would advance the essential quality 
improvement goals highlighted by the Institute of Medicine in its 
report, Crossing the Quality Chasm: A New Health System for the 20th 
Century. Commenters also said analyses of Part D claims data would be 
beneficial for developing comprehensive estimates of the costs of care, 
revealing the most cost effective disease therapies, and understanding 
beneficiaries' sensitivity to changes in cost sharing for drugs.
    Response: We agree with the many comments that Part D claims data 
will be essential for research analyses involving the elderly and 
disabled, and for other public health functions.
    Comment: Two commenters suggested that CMS implement a tiered 
system of access to Part D claims data. Specifically, they suggested we 
establish separate tiers for accessing the data, taking into account 
the need for data and the opportunity for abuse, which

[[Page 30674]]

would correlate to the following groups: (1) Government agencies; (2) 
contractors and researchers under contract with CMS or another 
government agency; and (3) outside researchers. They suggest that Part 
D claims data be available to the above-listed entities within 
appropriate parameters, but not be available to entities, such as 
pharmaceutical manufacturers and others with strong proprietary 
interests.
    Response: We considered several alternatives to the Medicare A/B 
data release process including restricting:
     Access to HHS agencies only,
     Access to Federal Government agencies only,
     Access to financial elements for outside researchers.
    We rejected these alternatives as too restrictive in light of the 
significant benefits to the Medicare program and the public's health in 
making Medicare Parts A, B, and D linked data available, with 
protections, to Federal and State government agencies, and external 
entities. We believe that our approach, which incorporates the Medicare 
A/B minimum necessary data policy with additional restrictions to 
protect privacy and plan commercially sensitive information, strikes an 
appropriate balance between these significant health benefits and the 
concerns regarding the release of proprietary data and preserving 
beneficiary confidentiality. Moreover, we believe this process has 
sufficient protections to ensure compliance with the applicable laws 
and guard against the potential misuse of data. External entities 
requesting access to Part D claims data will have to enter into an 
agreement with us that includes provisions protecting the data from 
improper release.
    Our regulation at Sec.  423.505(m), as well as the attached 
appendix provides additional guidance on the additional limitations 
that would apply to external entities (which would include CRS when not 
acting on behalf of a committee as an agent, but would not include 
States or other executive-branch Federal agencies) requesting Part D 
data. Cost data (consisting of ingredient cost, dispensing fee, and 
sales tax) could be released only in aggregated form. In addition, plan 
and other identifiers generally would be encrypted.
    We also intend to only release the minimum data necessary for a 
given project. Additionally, we also note that if an entity involved in 
a data release of electronic protected health information (EPHI) is a 
HIPAA-covered entity, the covered entity will have to comply with our 
HIPAA privacy and security standards. In addition, the covered entity 
should also follow the security guidance which was released in December 
2006. The guidance reinforces our existing security standards to 
specifically address remote access and use of EPHI. This reinforcement 
of the HIPAA security standards, particularly related to data in 
transit, will further protect Part D claims data from inappropriate 
release, and therefore inappropriate use. For more information on this 
guidance, please log on to http://www.cms.hhs.gov/SecurityStandard/.
    Comment: We requested comments on whether we should consider 
additional regulatory limitations for external researchers beyond our 
existing data use agreement protocols in order to further guard against 
the potential misuse of data for non-research purposes, commercial 
purposes, or to ensure that proprietary plan data or confidential 
beneficiary data are not released. In response, a number of commenters 
requested that CMS define the term ``commercial purposes'' clearly and 
narrowly so that a broader range of entities would have access to the 
data, including pharmaceutical manufacturers, insurance companies, and 
pharmacy benefit managers. These commenters argue that instead of 
precluding certain types of entities from accessing Part D claims data, 
it would be better to focus on assuring researcher quality and 
integrity, and on ensuring that researchers adopt sound methodologies 
in conducting analyses. Therefore, the commenters request that the 
``clear bias'' against pharmaceutical company supported research be 
removed from the CMS review criteria.
    As noted previously, other commenters suggested that the final 
regulation should deny access to data to organizations with strong 
proprietary interests, such as drug plan sponsors, pharmaceutical 
manufacturers, and other industry data collection entities that sell 
market research and sales data.
    Response: Under our current policies for Parts A and B data, we do 
not provide protected health information (PHI), as defined for purposes 
of HIPAA at 45 CFR 160.103, for commercial purposes, as we believe PHI 
should only be provided to entities conducting research that will 
result in generalizable knowledge in the public domain. We are 
concerned about the potential for conflicts of interest where 
commercial entities, whose primary purpose is not the creation of 
generalizable knowledge, might not publish results contrary to the 
firm's financial interest. However, we do allow external researchers to 
be funded by commercial firms, including pharmaceutical manufacturers, 
insurance companies, and pharmacy benefit managers when the research 
will contribute to general knowledge in the public domain and the 
researchers are free to publish the results of the research regardless 
of the findings. We continue to believe that any findings based on 
beneficiary identifiable data released by us should be unbiased by 
commercial incentives and should be in the public domain. The criteria 
governing releases of protected health information (PHI) for research 
are designed to ensure that the HIPAA Privacy Rule's requirements, as 
defined at 45 CFR 164.512(i), as well as our own policies are met. In 
this final rule, we use the definition of research contained in the 
HIPAA Privacy Rule, which defines the term as ``a systematic 
investigation, including research development, testing and evaluation, 
designed to develop or contribute to generalizable knowledge'' (45 CFR 
164.501). Thus, we do not release PHI to external entities when their 
research is not designed to develop or contribute to the generalizable 
knowledge. Nor do we release PHI to external entities for their 
commercial purposes or if they fail to demonstrate that they have a 
sound research methodology and that their research will produce 
findings relevant to the Medicare program and its beneficiaries.
    Therefore, we will continue to apply the same criteria in 
distinguishing between who may have access to data (researchers versus 
commercial interests), as we have been using for Parts A and B data. 
Because we intend to examine whether each proposed use of data meets 
the definition of research used under the HIPAA Privacy Rule, we will 
not be defining the term ``commercial purposes'' in this regulation.
    Comment: We received several comments relating to the Freedom of 
Information Act (FOIA), noting that releases under FOIA should not 
include information that would be considered proprietary in nature.
    Response: If a FOIA request is received, we will follow our 
ordinary FOIA procedures and not release under FOIA data the agency 
determines are trade secrets, or commercial or financial information 
protected by FOIA Exemption 4 (5 U.S.C. 552(b)(4)). These procedures 
were explained more fully in the preamble to the Part D final rule, 
where, in response to a question about protecting bid information under 
FOIA we stated:

    [B]idders can always seek to protect their information under the 
Freedom of Information Act and label truly proprietary information 
``confidential'' or ``proprietary''. When information is so labeled, 
the bidder is required to explain the applicability of the

[[Page 30675]]

FOIA exemption they are claiming. When there is a request for 
information that is designated by the submitter as confidential or 
that could reasonably be considered exempt under Exemption 4, the 
Department is required by its FOIA regulation at 45 CFR Sec.  
5.65(d) and by Executive Order 12,600 to give the submitter notice 
before the information is disclosed. To determine whether the 
submitter's information is protected by Exemption 4, the submitter 
must show that (1) disclosure of the information is likely to impair 
the government's ability to obtain necessary information in the 
future; (2) disclosure of the information is likely to cause 
substantial harm to the competitive position of the submitter; or 
(3) the records are considered valuable commodities in the 
marketplace which, once released through the FOIA, would result in a 
substantial loss of their market value. Consistent with our approach 
under the Part C program, we would not release information under the 
Part D program that would be considered proprietary in nature or 
that would tend to stifle the availability of discounts or rebates 
from pharmaceutical manufacturers negotiated by Part D plans.
    Bidders may identify trade secrets and confidential business 
information (CBI) with their submission. However, if they have not 
we will give them another chance when a FOIA request has been made 
on their records. In this case we will notify the business 
submitters that we are in receipt of FOIA requests for their 
records. We will then provide the business submitters with 
instructions and ask them to identify any trade secret or CBI in 
order to justify our application of Exemption 4. We will then review 
their justifications and highlighted information against FOIA case 
law to see if we can support their requested redactions. Under 
Executive Order 12600, if the business submitters disagree with our 
Exemption 4 analysis (which includes their justification) of their 
identified trade secret or CBI, they are provided the opportunity to 
seek a restraining order or injunction in Federal court prohibiting 
us from releasing their records under FOIA. (70 FR 4294 through 
4295)

    Thus, for example, we do not expect that any pricing data included 
on the claim that fits within FOIA Exemption 4 would be required to be 
released under FOIA.
    We also note that we do not view data releases made under the 
authority of the new Sec.  423.505(m) as FOIA releases. Unlike FOIA 
releases, these releases are not required by law. Section 423.505(m) 
permits the release of data, but does not require it.
    Comment: A number of commenters underscored the importance of CMS 
making patient identifiers available in order to achieve the full 
potential of Part D data. One commenter stated prescription drug claims 
files by themselves lack the diagnostic, outcomes and other information 
to support the needed studies. However, when merged with other data, 
they can become a powerful tool for improving the public health. 
Reflecting the views of several other commenters, the commenter noted 
that Part D claims data could be linked to several other data sets such 
as: death and birth certificate files; nursing homes Minimum Data Set; 
home health care Outcome and Assessment Information Set files; disease 
registries such as the Surveillance, Epidemiology, and End Results-
Medicare dataset developed by the National Cancer Institute to study 
outcomes of cancer therapies; geographical data on characteristics and 
health care resources of communities; information on characteristics of 
providers (for example, use of primary medical care versus specialty 
care); and Medicaid data on health care encounters and services not 
covered by Medicare. The commenter emphasized that linking Part D data 
to the above information is essential in order to provide accurate 
accounting for outcomes and to best address the many scientific 
pitfalls and potential threats to validity that emerge when one moves 
from experimental to observational studies, such as unobserved variable 
bias and confounding by indication or counter-indication.
    Another commenter stated that linkage of the Part D data to 
population-based surveys would provide invaluable sources for 
epidemiologic, health services and policy analyses and enable 
investigations into prevalence of diseases, their risk factors, 
progression, and trends in treatment and drug use.
    Response: We agree these data are more powerful when linked with 
other data sets. Linkage to Medicare Parts A and B data is essential 
for understanding the impact of the Part D benefit on use of other 
Medicare services. There are a host of other types of research studies 
that could not be completed without linked data. These include: studies 
examining the impact of changes in benefit structure on patient 
outcomes, research into the relative effectiveness of pharmacologic 
therapies or medication therapy management interventions, and 
pharmacovigilence studies. In many cases, Part A/B linked data provided 
through our chronic condition warehouse with encrypted identifiers will 
be sufficient to accomplish the research. In cases where beneficiary 
identifiers are essential for linkage with non-Medicare data bases, 
such as the National Center for Health Statistics Surveys, beneficiary-
identifiable data may be released, but will be subject to the Privacy 
Act and HIPAA data security and privacy requirements consistent with 
those we require in our data release policies for identifiable Part A/B 
data. These requirements include a CMS Privacy Board review/approval, 
submission of a Data Use Agreement, and the justification of minimum 
data necessary to carry out the project. If the data is going to be 
linked to data collected under another federally funded study, the 
requestor must also secure the Federal project officer's concurrence 
and an Institutional Review Board (IRB) approval.
    Comment: A few commenters were concerned that CMS had not 
adequately addressed the implications of expanding access to physician 
and patient information. They recommended that we specify more clearly 
the conditions under which physician data can be collected and used in 
performance programs, research studies, and demonstration projects, 
noting that revealing physician identification information will enable 
pharmaceutical companies and others to influence physicians' 
prescribing patterns and interfere with a physician's professional 
judgment.
    Response: We believe that an encrypted version of the physician 
identifier, which will allow for the linkage of all of a physician's 
claims without divulging the physician's identity, will meet the needs 
of most researchers. Accordingly, we will evaluate research requests 
for physician identifiers (for example, that could be used to link 
Medicare data at the physician level to other datasets) on a case-by-
case basis and will only consider providing them if necessary for the 
study under our minimum data necessary policy and permitted under 
applicable law. In addition, we will continue our current practice of 
not providing identifiable data for commercial purposes. This 
limitation should address the concern regarding pharmaceutical company 
interference with medical practice.
    In addition to releasing physician identifiers in response to 
certain research requests, we anticipate releasing physician 
identifiers to States, and pilot and demonstration projects, as the 
ability to link all of a physician's claims may be necessary for care 
coordination and disease management purposes. Physician identifiers may 
also be used by or released to other government agencies or 
contractors, as part of populating personal health records, so that 
beneficiaries will have a record of who prescribed their drugs. 
Finally, we anticipate that they may be used in connection with or 
released to support the Secretary's Value-driven Health Care initiative 
which seeks to

[[Page 30676]]

improve the quality and efficiency of health care delivery by making 
performance measurement information available to better support 
provider and consumer health care decision-making.
    One of the goals of the Secretary's Value-driven Health Care 
Initiative is to promote public reporting of performance measurement 
results at the provider and physician level that may be based on public 
sector claims, private sector claims, and other data in order to enable 
providers, including physicians, and consumers to make informed health 
care decisions. We envision using the claims data to develop provider 
and physician-level performance measurement results.
    Comment: A commenter supported CMS's use of Part D data to manage 
cost and clinical quality and argued that providing external parties 
access to linked physician identifiable claims in order to pool them 
with employer data would allow analysis to reduce the cost of care 
delivery and improve the quality of care. The commenter stated that 
increasing transparency of care in the outpatient sector is critical 
and that protecting physicians from oversight cannot continue.
    Response: We are undertaking a variety of pay for performance and 
value-based health care initiatives in an effort to encourage health 
care providers to furnish high quality health care and in order to 
provide cost and quality information to consumers. We intend to use the 
Part D claims data in these activities. Similarly, other Federal 
executive branch agencies (and their contractors) will have access to 
physician identifiers, if appropriate. We are working with external 
stakeholders, including multi-stakeholder coalitions that represent 
providers, consumers, employers, and health plans, regarding how to 
pool Medicare data with private data for analysis and how to make the 
results available to the public. As these plans mature, more 
information will be shared with the public.
    Comment: While many commenters supported the use of Part D claims 
data for detecting and analyzing unintended risks and benefits of 
medications, they also noted the limitations of claims-based research 
for answering questions about the comparative efficacy and safety of 
drugs. The commenters asserted that claims-based outcomes research, 
such as with Part D claims data, can reveal correlations between 
variables or events, but is often not sufficient to establish 
causation. They offered specific suggestions such as holding 
researchers to high methodological and ethical standards, creating 
study panels of qualified external stakeholder experts to review 
research protocols, and encouraging CMS to conduct an open and 
transparent process that will allow for external verification and 
replication of CMS's sponsored analyses.
    Response: We are well aware of the limitations involving 
retrospective, claims-based research. Our current data release policies 
for Parts A and B data for externally-funded research require that a 
requestor submit a detailed proposed research protocol. We review these 
proposals for the legitimacy and feasibility of the research, the 
strength of the proposed methods for guarding the privacy of the data, 
and the appropriateness of the research methods. Research requests for 
Part D claims data would be subject to the same type of review.
    Comment: Some commenters suggest that CMS make available the number 
of external requests it receives for claims data, the manner in which 
the agency responds to those requests, the timeliness of the approval 
process, and any fees charged for various types of data. They also 
believe that CMS should describe the Federal priorities for government-
sponsored research using Medicare Part D claims data, and provide for 
public notice and comment on proposals based on processes already 
established by Agency for Health Research and Quality (AHRQ).
    Response: We already maintain data on the number of external 
research requests for our claims data, whether the request was 
approved, the timeliness of the approval process, and any fees charged 
for various types of data. We can make this information available to 
the public, upon request, and will explore posting it on our Web site.
    We do not believe we should establish Federal priorities for 
research using Part D claims data, just as we do not establish 
priorities for research using Medicare Parts A and B data. Much of our 
research agenda is determined by directives from the Congress for 
research studies, demonstrations and their evaluation. Accordingly, a 
public comment process on CMS-sponsored research is not necessarily 
feasible. However, other Federal government executive branch agencies 
that are likely to sponsor comparative effectiveness or safety research 
using Part D claims data, such as AHRQ, do have such priority-setting 
processes in place. We believe these processes are adequate to address 
the commenters' concerns.
    Comment: A few commenters suggested that we make available Part D 
claims data to State Medicaid directors for the purpose of monitoring 
and researching the dual eligible population. The commenters suggested 
we provide States with access to the drug utilization and spending data 
collected by the Medicare Part D prescription drug plans, as well as 
other data necessary for states to effectively coordinate the care of 
dual eligibles.
    Response: We believe that States may improve their disease 
management and other care coordination programs by examining 
utilization data of dual eligibles extracted from Part D claims. In 
this final rule, we have clarified that we will be permitted to use 
collected Part D claims data for care coordination and disease 
management purposes. Under Sec.  423.505(m), we may release collected 
Part D claims data to States, consistent with our minimum data 
necessary policy, our data sharing procedures, applicable laws, and 
subject to encryption of certain identifiers and aggregation of cost 
data. We plan to explore the operational issues associated with such an 
exchange. As a result, we believe States will have appropriate access 
to Part D claims data for purposes of coordinating the care of dual 
eligible beneficiaries. Please see Sec.  423.505(m), as well as the 
appendix to this final rule for additional explanation of how we would 
determine the data that would be released to States.
    Comment: Commenters requested further discussion on the types of 
entities to which collected Part D claims data will be released. A 
commenter also contends that the recipients of data could share the 
data with third parties of their choice.
    Response: Identifiable data are not released to all external 
requesters. Currently, for Parts A and B data, external researchers 
must request the identifiable data from us. Our privacy board reviews 
the request for beneficiary identifiable data to determine if the 
request is for an appropriate research purpose, whether the Privacy 
Rule's criteria are met, and that the request is consistent with our 
data release policies. Our data release policies do not allow us to 
release identifiable data for marketing or commercial purposes. 
Further, we do not approve requests from for-profit organizations or 
organizations that could profit from a study, although we do produce 
databases with identifiers stripped, as well as public use files, for 
any organization to use. We also have requirements for release of Parts 
A and B data to other Federal governmental entities and contractors for 
purposes not related to research. Generally, we use DUAs to track the 
disclosure of personally identifiable data to such entities. Under our 
data sharing

[[Page 30677]]

policies, we generally require the requester not to disclose the data 
to third parties without specific written authorization from us. The 
release of data must also be permissible under the Privacy Act, the 
HIPAA Privacy Rule, the Trade Secrets Act, and any other applicable 
laws.
    Comment: A commenter recommended that CMS include a requirement 
that the recipient obtain a certification of confidentiality for all 
identifiable CMS data covered by the agreement or other data within the 
scope of the research project to protect researchers when compelled to 
release protected data.
    Response: Under section 301(d) of the Public Health Service Act (42 
U.S.C. 241(d)) the Secretary of Health and Human Services may authorize 
persons engaged in biomedical, behavioral, clinical, or other research 
to protect the privacy of individuals who are the subjects of that 
research. This authority has been delegated to the National Institutes 
of Health (NIH). Certificates of confidentiality are issued to protect 
identifiable research information from forced disclosure. Certificates 
of confidentiality may be appropriate for research that combines the 
direct study of human subjects with the use of identifiable Part D 
data. They allow the investigator and others who have access to 
research records to refuse to disclose identifying information on 
research participants in any civil, criminal, administrative, 
legislative, or other proceeding, whether at the Federal, State, or 
local level. Certificates of confidentiality may be granted for studies 
collecting information that, if disclosed, could have adverse 
consequences for subjects or damage their financial standing, 
employability, insurability, or reputation. By protecting researchers 
and institutions from being compelled to disclose information that 
would identify research subjects, certificates of confidentiality help 
achieve the research objectives and promote participation in studies by 
assuring confidentiality and privacy to participants. The Department 
would encourage researchers to explore with their institutional review 
boards or other knowledgeable experts the use of certificates of 
confidentiality where appropriate. If a researcher has obtained a 
certificate of confidentiality for a human subjects study, its 
protection would extend to all individually identifiable data on the 
research subjects in that study (including Part D data.) maintained in 
the research records. Additional information about certificates of 
confidentiality is available on our Web site at http://grants2.nih.gov/grants/policy/coc/.
    Comment: Several commenters stated their concern that the proposal 
would run afoul of Federal confidentiality protections for substance 
abuse laws such as 42 CFR Part 2.
    Response: As the commenter notes, regulations at 42 CFR Part 2 
``Confidentiality of Alcohol and Drug Abuse Patient Records,'' 
establish restrictions on the disclosure and use of alcohol and drug 
abuse patient records that are maintained in connection with the 
performance of any Federally-assisted alcohol and drug abuse program. 
These regulations limit disclosures of any patient-identifying 
information acquired by a Federally-assisted facility that provides 
alcohol or drug abuse diagnosis, treatment, or referral for treatment. 
We will work with Part D sponsors to ensure that these specifically 
protected claims are not redisclosed for purposes other than payment. 
One option that we plan to explore to comply with these regulations is 
to identify a set of drugs which are used for the treatment of alcohol 
and substance abuse (that is, Anatabuse and Vivtrol) and exclude 
associated PDEs for these drugs from any sample of PDEs used for 
purposes other than carrying out section 1860D-15 of the Act (that is, 
for nonpayment purposes).
    Comment: We received a number of comments on how the rule will be 
implemented. Commenters requested that CMS ensure that: Part D claims 
data file formats are consistent with other CMS data files; limited 
data sets (LDS) be available linking Medicare Parts A, B and D data; 
and files be in a clean format that is sufficiently detailed and 
secure. Other commenters requested that Part D claims data be made 
available in a linkable format that includes details of prescriptions 
by patient, time, and location, in order to address the shortcomings in 
the current management of chronic diseases.
    Response: We do not believe that the detailed formatting standards 
requested by the commenters are an appropriate subject of this final 
rule. However, we recognize the need to ensure appropriate security of 
data, and will apply the processes and procedures regarding the 
transmission and storage of data currently in place to protect Parts A 
and B data to Part D claims data. We also note that linked data files 
will contain both a patient's chronic conditions and detailed 
information regarding prescriptions.
    Comment: Several commenters recommended that CMS consider 
developing and releasing a summary file that parallels the current 
Physician Supplier Procedure Summary Master file along with a 5 percent 
sample standard analytical file. One commenter asked that both LDS 
files and Research Identifiable files be available and asked for 
clarification of the file types available from the CCW.
    Response: As stated, we do not believe that detailed formatting 
standards are the subject of this final rule. We also note that both 
LDS files and research identifiable files are available from the CCW. 
We anticipate filling most research requests for Part D claims data 
using LDS files available from the CCW or from other places.
    Comment: One commenter questioned how plan sponsors are to comply 
with applicable State privacy laws that may preclude disclosure of 
medical information for one or more of the purposes listed in the 
proposed regulatory text. The commenter requested that CMS explain 
whether any such conflicting state law prohibitions would be preempted 
by the proposed regulation, notwithstanding that Sec.  423.136 of the 
regulations states that state confidentiality and disclosure laws are 
not preempted.
    Response: Part D sponsors should comply with all applicable Federal 
and state confidentiality and disclosure laws when not directly 
conflicting. Part D regulations specifically require prescription drug 
plans to comply with these laws. If there is a belief that a particular 
State law is in direct conflict with our Federal requirements, plan 
sponsors should bring those specific cases to our attention for 
individual review.
    Comment: One commenter contended that CMS can share Part D claims 
data freely with its contractors, who may also be researchers, under 
section 1860D-15 of the Act.
    Response: Section 1860D-15 of the Act only relates to disclosures 
necessary to carry out that section, which would permit sharing of Part 
D data with contractors only for payment purposes. This regulation, 
which is established under the authority of section 1860D-12 of the 
Act, would permit us to collect the original 37 PDE elements comprising 
the Part D claims data for nonpayment-related purposes, and allow the 
agency and its contractors to use them for nonpayment-related purposes 
(section 1874 of the Act permits the Secretary to perform his functions 
by contract).
    Comment: A commenter contends that it is impossible to assess the 
intent of CMS without the ability to review the system of record notice 
for data collected under Part D. The commenter

[[Page 30678]]

wants CMS to republish the proposed rule along with the applicable 
system of records notice.
    Response: We believe the proposed rule contained enough information 
for interested parties to assess our intent. We plan to publish a 
revised system of records notice shortly to ensure that the regulation 
and its system of records are effective as close to the same time as 
possible.
    Comment: One commenter stated CMS should complete a Privacy Impact 
Assessment (``PIA'').
    Response: We annually update all appropriate PIAs. Accordingly, we 
will be updating the Drug Data Processing System PIA every year.
    Comment: A commenter recommended that the subjects of any data 
disclosed to a third party be parties to CMS's data use agreement, so 
that they may seek relief for a breach of the agreement.
    Response: The format and procedures for our data sharing agreements 
are not strictly within the scope of this final rule. Moreover, we do 
not believe the commenter's recommendation would be advisable because 
it may significantly hamper the ability of researchers to perform the 
activities that benefit the public's health under this rule. 
Researchers may ultimately expend an enormous amount of resources 
responding to third party claims. However, we do note that signatories 
of our data use agreements can be sanctioned if they violate the 
agreement or Federal law.
    Comment: We received several comments suggesting that we establish 
a process for reviewing research requests based on a `first in, first 
reviewed' process.
    Response: The internal procedures we use in reviewing requests for 
data are not strictly within the scope of this final rule, as the 
proposed rule did not make recommendations related to our data-sharing 
process. However, we do plan to continue the practice of giving 
government agencies first preference in the review process, and to 
require that such agencies abide by our data sharing procedures, which 
generally require a data sharing agreement.
    External research requests are usually reviewed in the month they 
are received with the exception of time sensitive research requests, 
which may be considered in an expedited manner, at our discretion. 
Because we expect a large volume of requests, there may be a delay 
between when a request is received, reviewed, and approved or denied. 
As we do currently with Parts A and B data requests, we will continue 
to carefully consider each research request with a review process that 
emphasizes compliance with applicable laws, including those governing 
the protection of privacy, first, followed by legitimacy of the 
requested study, and the requestor's expertise.

D. Beneficiary Access to Part D Claims Data

    The proposed rule stated that we were considering the use of Part D 
claims data for projects involving the development or population of 
personalized health records, which include beneficiary medication 
history, which would be accessible by Medicare beneficiaries or their 
providers after the beneficiary consents to such a release. We 
requested comments on this proposed use of Part D claims data collected 
under the authority of section 1860D-12(b)(3)(D) of the Act.
    In this final rule, after considering the comments received, we are 
expanding the use of the collected Part D claims data so that we may 
authorize the use and release of these data to government contractors 
or external entities for the population of personal health records.
    Comment: Generally, commenters encouraged CMS to pursue projects of 
this nature, with one commenter in particular noting that the 
personalized medication history record could be linked to the 
MyMedicare.gov Web site and could include links to a beneficiary's Part 
D plan, its formulary, and the plan's instructions for prior 
authorization requests.
    A few commenters requested more detail regarding the development of 
PHRs, the protection of beneficiary health information, and the Web-
based standards (that is, record security, record retrieval, browser 
compatibility, etc.) underlying the display of PHRs. They suggested 
that we use a transparent, public process for developing these ideas 
and allowing for public comments. One commenter referenced the URAC 
(the organization formerly known as the Utilization Review 
Accreditation Commission) standards for Web-based clinical content and 
another, the Medicare pilot demonstration project conducted by the 
United Mine Workers Health and Retirement Fund as a model of a project.
    Response: Currently, we are conducting pilot projects and studies 
on personal health records that include the disclosure of hospital and 
provider claims data (Part A and Part B) to populate beneficiaries' 
PHRs. However, until this rule is effective, we cannot include Part D 
claims data in these projects. When we have authority to disclose Part 
D claims data, we will provide the Part D claims data to populate PHRs 
only upon the authorization of the beneficiary. We require our partners 
in PHR pilots and studies to agree to strict privacy and security 
safeguards whenever receiving, using or disclosing beneficiary data. 
The pilots and studies are intended, in part, to help inform us in 
developing privacy rules and security arrangements that would be 
appropriate for a program of ongoing disclosures to populate and update 
the PHRs, as authorized by beneficiaries.
    In the area of health information technology, the Department has a 
history of developing policy in a collaborative, open, and transparent 
manner. In addition to obtaining public comment through notice in the 
Federal Register, such as this, the Department relies on its public 
advisory committees, relationships with industry, and participation in 
professional associations in developing policies and procedures with 
respect to the emerging health information environment. With regard to 
PHRs, the information we gather through this process will also help us 
determine future steps.
    Comment: Several commenters stated that beneficiary participation 
in such projects should not be mandatory, but voluntary.
    Response: We expect that any program we plan to undertake to make 
collected Part D claims data available to beneficiaries would be 
voluntary on the part of beneficiaries.
    Comment: A commenter noted that beneficiaries already have the 
right to request access to, inspect, and copy their medication 
histories and other PHI.
    Response: We appreciate the commenter's statements that 
beneficiaries already have access to their medical records, but believe 
that a centralized PHR that is easily accessible from a Web site, and 
that includes a more comprehensive set of data from multiple providers 
and prescribers, would be of use to beneficiaries.
    Comment: A commenter urged CMS to establish procedures where the 
data will be automatically available to other health care practitioners 
and institutions. The commenter stated that a beneficiary may be unable 
to release the record due to being unconscious or confused. Finally, 
the commenter noted reasons why, under Parts A and B, the personalized 
EHR is necessary, including the value of having a complete record in an 
emergency room situation and in instances when a physician administers 
medications incident to a physician visit.
    Response: Any PHI that CMS releases to providers or institutions 
would be

[[Page 30679]]

authorized by the beneficiary or the beneficiary's authorized 
representative or would be otherwise permitted or required under the 
applicable laws and our policies. Moreover, we note that health care 
providers are not necessarily the intended users of PHR; rather, they 
are intended for use by the patient. We believe it more likely that 
emergency room and other health care providers would have access to 
patient's medication history from another source.
    Comment: One commenter noted that Part D claims data may be of 
limited value in creating a PHR.
    Response: We believe that access to medication history information, 
even of limited scope, is deemed one of the top priorities by emergency 
responders, emergency room personnel and physicians, in discussions 
regarding electronic PHRs.
    Comment: A commenter noted that PHR information shared with 
entities other than the beneficiary should only be released in an 
aggregated format without any physician identifiers.
    Response: We requested comments on the usefulness of creating a 
personalized beneficiary medication history record from the Part D 
claims data. We are uncertain as to why the commenter believes it would 
only be appropriate for physician information to be released at the 
aggregate level since the purpose of PHRs is to allow individuals and 
their providers to have access to information to improve the quality 
and delivery of care to the individual. Any sharing of this data with 
organizations that assist beneficiaries in developing their own PHR 
would need to be authorized by the individual to whom the record 
pertains, just as the individual would provide authorization for 
release of any other of his or her personal data held by Medicare.

E. Applicability

    We stated in the proposed rule that the proposed revision does not 
affect the applicability of HIPAA to the DHHS or any other appropriate 
parties, nor does it affect the applicability of the Privacy Act (5 
U.S.C. 552a) or the Trade Secrets Act (18 U.S.C. 1905). Thus, Part D 
claims data, like any personally identifiable information or PHI 
collected by the agency, are subject to protection under the HIPAA 
Privacy Rule, the Privacy Act and the Trade Secrets Act, and other 
laws, as applicable. In this final rule, we continue to take this 
position.
    Comment: One commenter stated that the proposed rule does not 
explain why HIPAA does not apply to Part D activities when HIPAA does 
apply to CMS activities for Parts A and B of Medicare.
    Response: The HIPAA Privacy Rule applies to covered entities and 
defines the term ``covered entity'' as (1) a health plan, (2) a health 
care clearinghouse, or (3) a health care provider who transmits any 
health information in electronic form in connection with a covered 
transaction. (See 45 CFR 160.103.) HIPAA defines ``health plan'' as an 
individual or group plan that provides, or pays the cost of medical 
care, and specifically includes Part A and Part B of the Medicare 
program under title XVIII. (See section 1171(5) of the Act and 45 CFR 
160.103 (definition of health plan).) With respect to Part D, because 
Part D sponsors meet the definition of health plan, they are covered 
entities subject to HIPAA. HIPAA does not apply to the component of CMS 
that administers the Part D program because it is does not pay claims 
directly. However, although Part D claims information held by this 
component is not directly subject to HIPAA, the Part D data are 
protected under the Privacy Act of 1974, which applies to all federal 
agencies' data collections of individually identifiable information in 
systems of records. The Privacy Act requires that CMS maintain Part D 
data in a protected system of records and may only use or disclose the 
data in accordance with the specific purposes which have been published 
in the Federal Register and with other uses and disclosures allowed by 
the Privacy Act, itself. See 5 U.S.C. 552a(b) and (e)(4).
    This rule will allow the Secretary to use the original 37 PDE 
elements that are being collected for Part D payment purposes for 
reporting to the Congress and the public, conducting evaluations of the 
overall Medicare program, making legislative proposals to Congress, and 
conducting demonstration projects. To the extent that such information 
becomes part of our administration of the Medicare Part A and Part B 
programs, HIPAA will apply to such information. Moreover, although Part 
D claims information held by the component of CMS that administers the 
Part D program are not directly subject to HIPAA, we are choosing to 
comply with HIPAA's limitations on the use and disclosure of PHI to 
ensure that beneficiaries' privacy interests are fully protected. In 
addition, we are choosing to impose standards similar to those applied 
when we release beneficiary identifiable information with respect to 
non-beneficiary identifiable Part D data, on the PDE, such as plan, 
prescriber, and pharmacy identifiable data.
    Comment: One commenter noted that many plan sponsors already share 
data with agencies such as the FDA, NIH, and AHRQ, and external 
entities subject to HIPAA, therefore there is no need for this 
rulemaking.
    Response: While plan sponsors may already share data with agencies 
such as FDA, NIH, and AHRQ, only CMS can share Part D claims data 
linked to Medicare Parts A and B data. Therefore, we maintain that this 
rulemaking is necessary.
    Comment: Some commenters expressed concern with CMS' use of data 
use agreements. They asked that CMS explain the steps we will undertake 
to ensure the confidentiality of individually identifiable beneficiary 
data.
    Response: In response to the commenter's concerns about CMS' 
reliance on data use agreements (DUAs), we administer DUAs for any data 
disclosures to external entities, including limited data sets that 
exclude certain personal identifiers. The DUA is a way to ensure that 
the data provided are only used for the purposes for which the data 
were disclosed. All external requests for personally identifiable data 
for research are subject to CMS' Privacy Board review and approval.
    Currently, for Parts A and B data, CMS restricts data releases to 
the minimum amount of information necessary for the requestor's 
specific research project. We intend to operate on the same basis, with 
some additional restrictions to protect privacy and commercially 
sensitive information as described our regulations at Sec.  423.505(m) 
as well as in the appendix to this final rule, with respect to the 
release of collected Part D claims data. We anticipate that we will be 
able to satisfy many requests for Part D claims data using limited data 
sets, which exclude certain personal identifiers.
    Comment: A commenter was concerned with the release of prescriber 
identifiers, believing that the release of such data could be used to 
target marketing efforts and otherwise improperly affect a prescriber's 
judgment.
    Response: As explained previously in section II.B. of this final 
rule, we expect that the results of the Secretary's quality improvement 
and performance measurement initiatives may be made public in an effort 
to financially reward health care providers who provide high quality 
health care and to provide cost and quality information to consumers. 
Beyond that, we will encrypt prescriber identifiers as a general matter 
with limited exceptions (see 42 CFR 423.505(m), as well as the appendix 
to

[[Page 30680]]

this final rule). Additionally, we will not release Part D claims 
information for commercial purposes.
    Comment: A commenter contended that for a HIPAA-covered entity the 
proposed rule will impose a substantial compliance burden and monetary 
costs to transform each prescription drug claim that a plan sponsor 
submits for payment purposes into an accountable disclosure that the 
plan sponsor would need to track in order to fulfill its accounting of 
disclosures obligations under the HIPAA Privacy Rule. The commenter 
also stated that the proposal may burden plan sponsors by possibly 
requiring many to distribute revised notices of privacy practices, 
which may cause beneficiary confusion. The commenter states that CMS 
should be precluded from implementing the proposed rule except at the 
beginning of a calendar year.
    Response: Regularly, laws and regulations intersect or overlap, and 
individuals and entities are required to dissect the application of 
such laws and regulations, as appropriate. This rule does not regulate 
how covered entities, subject to HIPAA compliance, must comply with the 
HIPAA Privacy Rule, nor was it intended to do so. As a general matter, 
Part D plan sponsors are subject to a wide range of Federal laws and 
regulations, including HIPAA, and in this instance there may be an 
intersection between such laws and regulations that requires analysis 
and consideration. As we noted in the preamble to the proposed rule, 
nothing in this final rule affects the applicability of HIPAA (or the 
Privacy Act) to the DHHS or any other appropriate parties.
    Since the proposed rule did state that it did not affect the 
applicability of HIPAA, we believe a brief discussion of the 
intersection between this rule and existing HIPAA rules is warranted. 
However, it is important to note that the Office for Civil Rights (OCR) 
is the only agency within DHHS that can provide advice on and enforce 
the HIPAA Privacy Rule. Affected entities can obtain comprehensive 
information regarding the HIPAA Privacy Rule, including answers to 
frequently asked questions and information on the enforcement program, 
at http://www.hhs.gov/ocr/hipaa/.
    With this in mind, we believe that private plans are permitted by 
the HIPAA Privacy Rule to make the disclosures provided for in this 
Rule. The HIPAA Privacy rule permits disclosures for health oversight 
and as required by law. See 45 CFR 164.512(a) and 164.512(d). We are 
not suggesting that the HIPAA definition of ``required by law'' at 45 
CFR 164.103 encompasses contractual requirements. Rather, we believe 
those disclosures required by contract, which are also mandated by 
statute or regulation or both, would be ``required by law'' under the 
HIPAA Privacy Rule.
    As noted previously above, plans disclosing data under this rule 
may face HIPAA compliance issues regarding accounting and Notice of 
Privacy Practices. We believe that most Part D plans very likely have a 
statement in their existing Notices of Privacy Practices that notifies 
enrollees of permitted disclosures for purposes of health oversight and 
as required by law, and therefore, are unlikely to have to modify their 
notices of privacy practices.
    An individual also has the right under the HIPAA Privacy Rule to 
receive an accounting of certain disclosures, including disclosures for 
health oversight purposes or disclosures required by law. It is each 
plan's responsibility to comply with the HIPAA Privacy Rule as it deems 
appropriate.
    Finally, we do not believe that any further delay in the effective 
date for this regulation is required. We believe the commenters are 
referencing the prohibition on mid-year significant regulatory 
requirements at 42 CFR 423.516. However, that regulation does not apply 
to already-existing regulations, such as HIPAA regulations, or the 
impact already-existing regulations will have on a new Part D 
regulation. Because we already collect Part D claims data, this 
regulation does not impose additional Part D requirements on Part D 
sponsors, and therefore, we do not view this regulation as constituting 
a significant midyear change for Part D sponsors.
    Comment: The commenter also questioned how CMS would notify 
beneficiaries that their data may be released for research purposes.
    Response: As a general matter, how we comply with our own HIPAA 
obligations is outside the scope of the proposed rule. To the extent 
HIPAA requires us to take any additional steps (including additional 
notification responsibilities) to ensure full compliance with HIPAA, we 
intend to do so. For instance, a covered entity is required to include 
in its notice of privacy practices a statement that PHI may be used for 
research purposes. CMS, as a covered entity for Medicare Parts A and B, 
currently provides such notice to beneficiaries annually.
    Comment: Several commenters requested that CMS discuss the 
regulation in light of the Trade Secrets Act, specifically with respect 
to pricing data.
    Response: Because our regulations at 42 CFR 423.505(f), (l), and 
(m) are issued under the authority of section 1106 of the Act, any 
release of potentially proprietary data under these regulations would 
also be authorized by law under the Trade Secrets Act. As we have 
stated elsewhere in this preamble, we believe that our minimum data 
necessary policy with some additional restrictions to protect privacy 
and plan commercially sensitive information and our data sharing 
procedures will guard against any potential misuse or inappropriate 
disclosure of Part D claims data.

F. Limitations

    This final rule in no way affects or limits our existing ability to 
collect non-payment data such as enrollment, formulary, price 
comparison, quality assurance and utilization review data. In such 
cases, even where the data collection is not specifically mandated by 
statute, we do not believe it is necessary to resolve any statutory 
ambiguity, because section 1860D-15 of the Act would not apply.
    In addition, it is important to note that this rule applies when 
collections of data occur under section 1860D-12 of the Act. The rule 
does not address collections that occur under other provisions of law. 
Thus, this rule also does not address uses or disclosures already 
permitted under section 1860D-15 of the Act, to carry out audits and 
evaluations necessary to ensure accurate and correct payment and to 
otherwise oversee Medicare reimbursement under Part D. These uses are 
already contemplated under both the statute and the regulations at 
Sec.  423.322(b). Furthermore, section 1860D-15 of the Act and Sec.  
423.322(b) of our regulations do not limit the ability of OIG to 
access, use, or disclose Part D claims data as part of the Inspector 
General's statutory responsibilities to oversee the Medicare program.

III. Provisions of the Final Regulations

    This final rule finalizes most of the provisions of the proposed 
rule. Those provisions of this final rule that differ from the proposed 
rule are as follows:
     In part 423, adding section 1106 of the Act to the 
authority citation.
     In Sec.  423.1, adding section 1106 of the Act.
     In Sec.  423.505, making the following changes:
    ++ Revising paragraph (f)(3) to clarify that the regulatory 
provision is only applicable to Part D claims data and is limited to 
the original 37 elements

[[Page 30681]]

reported on the PDE record; to add a reference to pilot projects, and 
to add care coordination and disease management activities, quality 
improvement and performance measurement activities, and the populating 
of personal health records to the list of necessary and appropriate 
purposes for the collection of this information. This list is not 
intended to be exclusive, and Part D claims data may be collected for 
other purposes that the Secretary deems necessary and appropriate.
    ++ Removing paragraph (f)(5) and incorporating the provisions of 
this paragraph in paragraphs (l) and (m).
    ++ Adding a new paragraph (l) to specify that CMS may use the data 
collected under Sec.  423.505(f)(3).
    ++ Adding a new paragraph (m) to specify that CMS may release the 
minimum data collected under Sec.  423.505(f)(3) in accordance with 
applicable Federal laws, our established data sharing procedures, and 
subject to encryption of certain identifiers and aggregation of cost 
data to protect beneficiary confidentiality and commercially sensitive 
data of Part D sponsors.

IV. Collection of Information Requirements

    Under the Paperwork Reduction Act of 1995, we are required to 
provide 30-day notice in the Federal Register and solicit public 
comment before a collection of information requirement is submitted to 
the Office of Management and Budget (OMB) for review and approval. In 
order to fairly evaluate whether an information collection should be 
approved by OMB, section 3506(c)(2)(A) of the Paperwork Reduction Act 
of 1995 requires that we solicit comment on the following issues:
     The need for the information collection and its usefulness 
in carrying out the proper functions of our agency.
     The accuracy of our estimate of the information collection 
burden.
     The quality, utility, and clarity of the information to be 
collected.
     Recommendations to minimize the information collection 
burden on the affected public, including automated collection 
techniques.
    This document does not impose new information collection 
requirements on Medicare Part D plans. Medicare Part D plan sponsors 
already submit the information required to conduct the studies 
discussed earlier in the preamble of this document. Medicare Advantage 
prescription drug plan (MA-PD) sponsors, prescription drug plan (PDP) 
sponsors, and Fallback plan sponsors, as required by the MMA, are 
required to submit payment-related data to CMS that include, but are 
not limited to, Part D claims data. The information collection 
requirements associated with the collection of prescription drug data 
from MA-PD, PDP and Fallback plan sponsors for Medicare Part D payments 
are currently approved under the Office of Management and Budget (OMB) 
Control No. 0938-0982, with an expiration date of November 30, 2009. 
Additionally, we have included a discussion of the currently approved 
information collection requirements associated with the Medicare Part D 
reporting requirements and the plan benefit package (PBP) and formulary 
submission for Medicare Advantage prescription drug plans (MA-PD) and 
prescription drug plans (PDPs). The information collection requirements 
(ICRs) for the Part D reporting requirements and the plan benefit 
package are approved under OMB Control Nos. 0938-0992 and 0938-0763, 
respectively.

A. ICRs Regarding Contract Provisions (Sec.  423.505)

    Section 423.505 discusses provisions that must be contained in 
contracts between Part D plan sponsors and CMS. Specifically, Sec.  
423.505(b)(8) requires that a Part D plan sponsor comply with the 
disclosure and reporting requirements in Sec.  423.505(f), Sec.  
423.514, and Sec.  423.329(b), respectively. Section 423.505(f) lists 
the information that Part D plan sponsors are required to disclose to 
CMS. This information includes but is not limited to the disclosure of 
certified financial information, the disclosure of all information 
necessary for us to administer and evaluate the program and to 
simultaneously establish and facilitate a process for current and 
prospective beneficiaries to exercise choice in obtaining prescription 
drug coverage, and the disclosure to its enrollees of all informational 
requirements under Sec.  423.128 and, upon an enrollee's request, the 
financial disclosure information required under Sec.  423.128(c)(4).

B. ICRs Regarding Reporting Requirements (Sec.  423.514)

    Section 423.514 outlines the reporting requirements for Part D plan 
sponsors. Section 423.514(a) requires each Part D plan sponsor to have 
an effective procedure to develop, compile, evaluate, and report to 
CMS, to its enrollees, and to the general public, at the times and in 
the manner that CMS requires. Section 423.514(b) requires Part D plan 
sponsors to report to CMS annually, within 120 days of the end of its 
fiscal year, significant business transactions. In addition, Sec.  
423.514(c) sets forth the requirements for submitting combined 
financial statements. For any employees' health benefits plan that 
includes a Part D plan sponsor in its offerings, Sec.  423.514(d) 
addresses the reporting and disclosure obligations under the Employee 
Retirement Income Security Act of 1974 (ERISA). Section 423.514(e) 
states that each Part D plan sponsor must notify CMS of any loans or 
other special financial arrangements it makes with contractors, 
subcontractors and related entities. Section 423.514(f) requires each 
Part D plan sponsor to make the information reported to CMS under this 
section available to its enrollees upon reasonable request.

C. ICRs Regarding Determination of Payments (Sec.  423.329)

    Section 423.329(b) contains the reporting requirements for PDPs and 
MA-PDs for the purposes of determining health status risk adjustment. 
As stated in Sec.  423.329(b)(3)(i), PDPs are required to submit data 
regarding drug claims that can be linked at the individual level to 
Part A and Part B data in a form and manner similar to the process 
provided under Sec.  422.310 of this chapter and other information as 
we determine necessary. In addition, Sec.  423.329(b)(3)(ii) requires 
MA organizations that offer MA-PD plans to submit data regarding drug 
claims that can be linked at the individual level to other data that 
the organizations are required to submit to CMS in a form and manner 
similar to the process provided under Sec.  422.310 and other 
information as we determine necessary.

D. ICRs Regarding Contract Provisions (Sec.  423.505(b)(8))

    The burden associated with the requirements in Sec.  423.505(b)(8) 
of this regulation is the time and effort associated with meeting the 
aforementioned requirements in Sec.  423.505(f), Sec.  423.514, and 
Sec.  423.329(b). As stated earlier, these requirements are subject to 
the PRA; however, they are approved under existing OMB control numbers. 
The requirements in Sec.  423.505(f) and Sec.  423.514 are currently 
approved under OMB control number 0938-0992 with an expiration date of 
June 30, 2008. The information collection requirements contained in 
Sec.  423.329(b) are currently approved under OMB control number 0938-
0763, with an expiration date of November 30, 2009.

[[Page 30682]]



                          Table 1.--Estimated Annual Reporting and Recordkeeping Burden
----------------------------------------------------------------------------------------------------------------
                                                                                    Burden per     Total annual
       Regulation section           OMB Control      Number of       Number of       response         burden
                                      number        respondents      responses        (hours)         (hours)
----------------------------------------------------------------------------------------------------------------
Sec.   423.505 ** and Sec.             0938-0992           3,203         179,368             .69         123,764
 423.514 **.....................
Sec.   423.329 **...............       0938-0763             430           4,515            2.29        **10,319
                                 -------------------------------------------------------------------------------
    Total.......................  ..............  ..............  ..............  ..............         138,469
----------------------------------------------------------------------------------------------------------------
** As specified by Sec.   426.505(b)(8)

    As required by section 3504(h) of the Paperwork Reduction Act of 
1995, we have submitted a copy of this document to the Office of 
Management and Budget (OMB) for its review of these information 
collection requirements.

V. Regulatory Impact Statement

    We have examined the impact of this rule as required by Executive 
Order 12866 (September 1993, Regulatory Planning and Review), the 
Regulatory Flexibility Act (RFA) (September 19, 1980, Pub. L. 96-354), 
section 1102(b) of the Social Security Act, the Unfunded Mandates 
Reform Act of 1995 (Pub. L. 104-4), Executive Order 13132 on Federalism 
and the Congressional Review Act (5 U.S.C. 804 (2)).
    Executive Order 12866, as amended, directs agencies to assess all 
costs and benefits of available regulatory alternatives and, if 
regulation is necessary, to select regulatory approaches that maximize 
net benefits (including potential economic, environmental, public 
health and safety effects, distributive impacts, and equity). A 
regulatory impact analysis (RIA) must be prepared for major rules with 
economically significant effects ($100 million or more in any 1 year). 
This final rule does not have economically significant effects of $100 
million or more in any one year and therefore is not a major rule.
    We assessed alternatives, including, not releasing data to any 
entity meeting the applicable criteria. We determined that the approach 
that maximizes public health benefits is the approach taken in the 
final regulation, which would use a case-by-case evaluation approach 
similar to the process in use today for Medicare Parts A and B data, 
with some additional restrictions to protect privacy and commercially 
sensitive data of Part D sponsors. Weighing all factors, this approach 
limits the risk that sensitive Part D claims data will be released to 
inappropriate entities leading to the inappropriate use of this 
sensitive data, but maximizes the benefit that this data can provide in 
supporting research studies and other actions that will benefit the 
public.
    We do not believe that new costs associated with compliance under 
this regulation, if any, will be significant. As stated in section II. 
E. of this final rule, we expect risk and compliance burdens to be 
limited; therefore any costs associated with compliance or 
inappropriate use of data are expected to be limited, and because the 
use of these data according to applicable laws and CMS data release 
policies is expected to improve the public's health, this rule does not 
reach the economic threshold and thus is not considered a major rule 
requiring a RIA.
    The RFA requires agencies to analyze options for regulatory relief 
of small businesses. For purposes of the RFA, small entities include 
small businesses, nonprofit organizations, and small governmental 
jurisdictions. Most hospitals and most other providers and suppliers 
are small entities, either by nonprofit status or by having revenues of 
$6 million to $29 million in any 1 year. Individuals and states are not 
included in the definition of a small entity. While a number of Part D 
plan sponsors are small entities due to their nonprofit status, few, if 
any, of the Part D plan sponsors meet the size standard for a small 
insurance firm by having revenues of $6 million or less in any 1 year. 
Therefore, an analysis for the RFA will not be prepared because the 
Secretary has determined that this final rule will not have a 
significant economic impact on a substantial number of small entities. 
Furthermore, we believe, the rule does not create a significant 
economic impact on Part D plan sponsors.
    In addition, section 1102(b) of the Act requires us to prepare a 
regulatory impact analysis if a rule may have a significant impact on 
the operations of a substantial number of small rural hospitals. This 
analysis must conform to the provisions of section 604 of the RFA. An 
analysis for section 1102(b) of the Act will not be prepared because 
the Secretary has determined that this final rule will not have a 
significant impact on the operations of a substantial number of small 
rural hospitals. In fact, we do not expect that it will have any impact 
on small rural hospitals because the rule relates to Part D plan 
sponsors, not small rural hospitals.
    Section 202 of the Unfunded Mandates Reform Act of 1995 also 
requires that agencies assess anticipated costs and benefits before 
issuing any rule whose mandates require spending in any 1 year of $100 
million in 1995 dollars, updated annually for inflation. That threshold 
level is currently approximately $130 million. This final rule will not 
contain mandates having a negative effect on state, local, or tribal 
governments in the aggregate, or by the private sector, of $130 
million.
    Executive Order 13132 establishes certain requirements that an 
agency must meet when it promulgates a final rule that imposes 
substantial direct requirement costs on state and local governments, 
preempts State law, or otherwise has Federalism implications. Even 
though states may incur costs associated with exchanging data, this 
regulation does not require states to request Part D claims data, but 
makes it an option, provided we can resolve any operational issues. In 
fact, even if States do request data, they may already have systems in 
place to receive data from CMS. Furthermore, we are not aware of any 
conflict between this final regulation and State privacy laws (with 
which Part D sponsors must comply per our regulations). Therefore, we 
do not believe this final regulation will implicate a Federalism issue 
through an impact on State privacy laws. Since this regulation does not 
impose any costs on state or local governments, the requirements of 
Executive Order 13132 are not applicable.
    We received the following comments regarding the impact analysis of 
the proposal rule:
    Comment: One commenter stated that because of the monetary cost and 
other compliance burdens associated with the implementation of this 
regulation due to HIPAA, this rule, if implemented, must be implemented 
at the beginning of a calendar year per Sec.  423.516.
    Response: We address this comment in section II. E. of this final 
rule.
    Comment: A commenter stated that in determining whether the 
rulemaking

[[Page 30683]]

met the $100 million threshold the value of the information to 
beneficiaries should have been considered. The commenter states that 
the value would surpass $100 million, since brokers rent lists 
potentially for $5 million per rental, often several times a year.
    Response: Under our data release policies, we would not allow the 
release of Part D claims data for commercial purposes. Thus, we do not 
believe the $100 million threshold would be met based on the example 
cited by the commenter. It is unlikely that list brokers will receive 
any nonpublic data from CMS.
    In accordance with the provisions of Executive Order 12866, this 
regulation was reviewed by the Office of Management and Budget.

List of Subjects in 42 CFR Part 423

    Administrative practice and procedure, Medicare, Prescription 
Drugs, Reporting and recordkeeping.

0
For the reasons set forth in the preamble, the Centers for Medicare & 
Medicaid Services amends 42 CFR chapter IV as set forth below:

PART 423--VOLUNTARY MEDICARE PRESCRIPTION DRUG BENEFIT

0
1. The authority citation for part 423 is amended to read as follows:

    Authority: Sections 1102, 1106, 1860D-1 through 1860D-42, and 
1871 of the Social Security Act (42 U.S.C. 1302, 1306, 1395w-101 
through 1395w-152, and 1395hh).

Subpart A--General Provisions

0
2. Section 423.1 is amended by adding a new reference to paragraph 
(a)(1) in numerical order to read as follows:


Sec.  423.1  Basis and scope

    (a) * * *.
    (1) * * *.
    1106. Disclosure of Information in Possession of Agency.
* * * * *

Subpart K--Application Procedures and Contracts With Part D Plan 
Sponsors

0
3. Section 423.505 is amended by--
0
A. Revising paragraph (b)(8).
0
B. Redesignating paragraph (f)(3) as (f)(4).
0
C. Adding new paragraph (f)(3).
0
D. Adding new paragraphs (l) and (m).
    The revisions and additions read as follows:


Sec.  423.505  Contract provisions.

* * * * *
    (b) * * *
    (8) Comply with the disclosure and reporting requirements in Sec.  
423.505(f), Sec.  423.514, and the requirements in Sec.  423.329(b) of 
this part for submitting current and prior drug claims and related 
information to CMS for its use in risk adjustment calculations and for 
the purposes of implementing Sec.  423.505(f), (l), and (m) and Sec.  
423.329(b) of this part.
* * * * *
    (f) * * *
    (3) The 37 original data elements included in all of its drug 
claims for purposes deemed necessary and appropriate by the Secretary, 
including, but not limited to, the following:
    (i) Reporting to Congress and the public on overall statistics 
associated with the operation of the Medicare prescription drug 
program.
    (ii) Conducting evaluations of the overall Medicare program, 
including the interaction between prescription drug coverage under Part 
D of Title XVIII of the Social Security Act and the services and 
utilization under Parts A, B, and C of title XVIII of the Act and under 
titles XIX and XXI of the Act, as well as other studies addressing 
public health questions.
    (iii) Making legislative proposals to the Congress regarding 
Federal health care programs and related programs.
    (iv) Conducting demonstration and pilot projects and making 
recommendations for improving the economy, efficiency, or effectiveness 
of the Medicare program.
    (v) Supporting care coordination and disease management programs,
    (vi) Supporting quality improvement and performance measurement 
activities, and;
    (vii) Populating personal health care records.
* * * * *
    (l) CMS may use the information collected under paragraph (f)(3) of 
this section. Any restriction set forth by Sec.  423.322(b) of this 
part must not be construed to limit the Secretary's authority to use 
the information collected under paragraph (f)(3).
    (m)(1) CMS may release the minimum data necessary for a given 
purpose from the data collected under paragraph (f)(3) of this section 
to Federal executive branch agencies, congressional oversight agencies, 
States, and external entities in accordance with the following:
    (i) Applicable Federal laws.
    (ii) CMS data sharing procedures.
    (iii) Subject, in certain cases, to encryption of certain 
identifiers and aggregation of cost data to protect beneficiary 
confidentiality and commercially sensitive data of Part D sponsors, in 
accordance with all of the following principles:
    (A) Subject to the restrictions in this paragraph, all elements on 
the claim are available to congressional oversight agencies (as defined 
in paragraph (m)(1)(iv) of this section) and HHS.
    (B) Cost data elements on the claim generally are aggregated for 
releases to other executive branch agencies, States, and external 
entities.
    (C) Plan identifier elements on the claim are encrypted or 
unavailable for releases to external entities.
    (D) Beneficiary, pharmacy, and prescriber identifier elements on 
the claim generally are encrypted for releases to external entities, 
except in limited circumstances, such as to link to another data set.
    (iv) For purposes of paragraph (m)(1)(iii) of this section, 
congressional oversight agencies (the Congressional Budget Office, the 
Government Accountability Office, the Medicare Payment Advisory 
Commission, and the Congressional Research Service when acting on 
behalf of a congressional committee in accordance with 2 U.S.C. 
166(d)(1)), States, and executive-branch Federal agencies are not 
considered to be external entities.
    (2) Any restriction set forth by Sec.  423.322(b) of this part must 
not be construed to limit the Secretary's authority to release the 
information collected under paragraph (f)(3) of this section.


(Catalog of Federal Domestic Assistance Program No. 93.773, 
Medicare--Hospital Insurance; and Program No. 93.774, Medicare--
Supplementary Medical Insurance Program)
    Dated: February 25, 2008.
Kerry Weems,
Acting Administrator, Centers for Medicare & Medicaid Services.
    Approved: March 17, 2008.
Michael O. Leavitt,
Secretary.
    The following appendix will not appear in the Code of Federal 
Regulations.

Appendix--Data Element Availability Under Section 1860D-12 of the 
Social Security Act by Type of Requestor

    CMS and its contractors have access to all PDE elements. This chart 
shows the data elements that are available for release to other federal 
and state agencies and external entities in the final rule under our 
minimum necessary data policy subject, in certain cases, to encryption 
of certain identifiers and aggregation of cost data to protect 
beneficiary confidentiality and commercially sensitive data of Part D 
sponsors. Thus, a requestor would not automatically receive all of the 
available elements, but would only receive those necessary for their 
study. (Note: As

[[Page 30684]]

stated in the preamble to the final rule, this chart applies only when 
data is collected under section 1860D-12 of the Act, and does not apply 
to any uses or disclosures already permitted under section 1860D-15 of 
the Act, including to carry out audits and evaluations necessary to 
ensure accurate and correct payment and to otherwise oversee Medicare 
reimbursement under Part D. These uses are already contemplated under 
both the statute and the regulations at Sec.  423.322(b) and are not 
the subjects of this final rule.)

----------------------------------------------------------------------------------------------------------------
                                        Other (i.e., non-CMS)
                                          DHHS entities, and       Non-HHS Executive
            Data elements              Congressional Oversight    Branch Agencies and       External entities
                                         Agencies* See Note 1            States
----------------------------------------------------------------------------------------------------------------
Identifiers
----------------------------------------------------------------------------------------------------------------
Encryption permits analysis on a beneficiary, plan, prescriber, or pharmacy level without disclosure of the
 actual identifying information. CMS will link our data to other data files, to the extent feasible, to minimize
 the extent to which other parties need identifiers for data linkage purposes. CMS has the sole authority to
 determine whether a particular data element is needed for a request.
----------------------------------------------------------------------------------------------------------------
Beneficiary ID (HIC Number,            Encrypted, but           Encrypted, but           Encrypted, but
 Cardholder ID, Patient date of         available if needed.     available if needed.     available if needed to
 birth) See Note 2.                                                                       link to another
                                                                                          dataset.
Plan ID (PBP identifier, Contract      Encrypted, but           Encrypted, but           Encrypted.
 identifier) See Note 3.                available if needed.     available if needed.
                                       Additionally,
                                        nonencrypted data will
                                        be available for
                                        purposes of
                                        performance measures.
Prescriber ID (Prescriber Identifier)  Encrypted, but           Encrypted, but           Encrypted, but
 See Note 4.                            available if needed.     available if needed.     available if needed to
                                                                                          link to another
                                                                                          dataset.
                                       Additionally,
                                        nonencrypted data will
                                        be available for
                                        purposes of
                                        performance measures.
Pharmacy ID (Service provider          Encrypted, but           Encrypted, but           Encrypted, but
 identifier) See Note 5.                available if needed.     available if needed.     available if needed to
                                                                                          link to another
                                                                                          dataset.
Qualifying Identifiers (Service &      Available..............  Available..............  Available.
 Prescriber Identifier Qualifiers--
 codes that denote whether NPI,
 NCPDP, UPIN, state license number,
 DEA, or non-standard code is used).
Internal plan/pharmacy prescription    Available..............  Unavailable............  Unavailable.
 identification numbers (Claim
 Control Number--a code intended for
 the plan to identify unique events &
 Prescription Service Reference
 Number--a code assigned by the
 pharmacy at the time the
 prescription is filled).
----------------------------------------------------------------------------------------------------------------
Drug Utilization Information
----------------------------------------------------------------------------------------------------------------
Date of Service......................  Available..............  Available..............  Available.
Drug information (Product/Service      Available..............  Available..............  Available.
 Identifier, Quantity Dispensed, Days
 Supply, Compound Code, Fill Number,
 Dispensing Status.).
Other utilization information          Available..............  Available..............  Available.
 (Dispense as Written/Product
 Selection Code, Drug Coverage Status
 Code).
----------------------------------------------------------------------------------------------------------------
Drug Cost Information
----------------------------------------------------------------------------------------------------------------
Total Drug Costs (Ingredient Cost,     Available,               Available, Aggregated..  Available, Aggregated.
 Dispensing Fee, Total Amount           Disaggregated.
 Attributable to Sales Tax) See Note
 6.
----------------------------------------------------------------------------------------------------------------
Coverage Information
----------------------------------------------------------------------------------------------------------------
Date Paid............................  Available..............  Available..............  Available.
Plan Paid Amounts (Covered D Plan      Available..............  Available..............  Available.
 Paid Amount, Non-covered Plan Paid
 Amounts).
Beneficiary cost sharing (Patient Pay  Available..............  Available..............  Available.
 Amount,).
Other Payer Amounts (Other True Out    Available..............  Available..............  Available.
 of Pocket Amount, Patient Liability
 due to Other Payer Amount).
Low-Income Subsidy Amount............  Available..............  Available..............  Available.
Other Financial Information (Gross     Available..............  Available..............  Available.
 Drug Cost below Out-of-pocket
 Threshold, Gross Drug Cost above Out-
 of-pocket Threshold).
----------------------------------------------------------------------------------------------------------------
Other Descriptive Data
----------------------------------------------------------------------------------------------------------------
Patient gender.......................  Available..............  Available..............  Available.

[[Page 30685]]

 
Catastrophic Coverage Indicator        Available..............  Available..............  Available.
 (Catastrophic Coverage Code).
In-network versus OON or MSP claim     Available..............  Available..............  Available.
 (Pricing Exception code).
Electronic versus Paper Claim (Non-    Available..............  Available..............  Available.
 Standard format Code).
Original versus Adjusted PDE           Available..............  Final Action claims      Final Action claims
 (Adjustment/Deletion code).                                     would be provided, so    would be provided, so
                                                                 this element should      this element should
                                                                 not be needed.           not be needed.
----------------------------------------------------------------------------------------------------------------
Generally, the notes apply to all columns across the row.
Note 1--Congressional oversight agencies include GAO, MedPAC, and CBO. CRS is considered a Congressional
  oversight agency, but only when acting on behalf of a committee pursuant to its authority in 2 U.S.C. Sec.
  166(d)(1). Otherwise, CRS is considered to be an external entity. Note also that OIG has authority independent
  of both sections 1860D-12 and 1860D-15 of the Social Security Act to collect data.
Note 2--CMS will encrypt all beneficiary identifiers unless they are needed. An example of where they might be
  needed is linkage to another dataset. When CMS sends real identifiers in order to permit the requestor to link
  files, CMS will encrypt identifiers during transmission, provide a link key to unencrypt the files, allow the
  linkage, and then require the requestor to re-encrypt identifiers. Public disclosure of research results will
  not include beneficiary identifying information.
Note 3--In general, CMS will link the Part D claims to plan level benefits and formulary data if needed by the
  requestor, and then encrypt the plan ID. However, CMS will not link certain information if it will lead to a
  de facto identification of the plan. CMS may develop plan specific performance measures which are publicly
  reported.
Note 4--CMS will link to physician characteristics from CMS files if needed by the requestor. Generally, when
  CMS sends real identifiers in order to permit the requestor to link files, CMS will encrypt identifiers during
  transmission, provide a link key to unencrypt the files, allow the linkage, and then require the requestor to
  re-encrypt identifiers.
Note 5--To the extent available, CMS will provide pharmacy characteristics from CMS files. However, CMS will not
  release pharmacy ID, together with drug cost information, in order to guard against the disclosure of
  negotiated price information.
Note 6--Generally, CMS will aggregate ingredient cost, dispensing fee, and sales tax at the individual claim
  level. Upon request, CMS will exclude sales tax from the aggregation at the individual claim level if
  necessary for the project.

[FR Doc. 08-1298 Filed 5-22-08; 1:30 pm]
BILLING CODE 4120-01-P