Data Validation FAQs_20101019

D epartment of Health & Human Services

Centers for Medicare & Medicaid Services

7500 Security Boulevard

Baltimore, Maryland 21244-1850

C enter for Medicare

TO: All Medicare Advantage Organizations, Part D Sponsors, and 1876 Cost Plans

FROM: Cynthia G. Tudor, Ph.D., Director, Medicare Drug Benefit and C & D Data Group

SUBJECT: Industry Update Regarding the Medicare Part C and Part D Data Validation Program

DATE: October 19, 2010

The Centers for Medicare & Medicaid Services (CMS) requires that organizations contracted to offer Medicare Part C and Part D benefits be subject to an independent yearly review to validate data reported to CMS on a variety of reporting requirements. This data validation review will determine the data’s reliability, validity, completeness, and comparability in accordance with the data validation standards that CMS has developed. These standards and other documentation associated with the implementation of the data validation program assess an organization’s information systems capabilities and overall processes for collecting, storing, compiling, and reporting the required Part C and Part D data measures.

CMS has received a large number of questions and comments regarding the data validation for Medicare Part C and Part D reporting requirements. To address these questions in a way that all sponsoring organizations can benefit from the responses, CMS is pleased to release a “Frequently Asked Questions (FAQ)” document (see attached) to provide clarifying information.

CMS is currently awaiting OMB review and approval of the data validation documentation in compliance with the Paper Reduction Act of 1995 and is targeting a release date of late 2010 for the final version of the data validation standards, associated documentation, and additional information on the specifics of implementation.

Thank you for your interest in this important matter. If you have additional questions regarding the data validation program, please direct them to: [email protected]. Questions regarding the Part C and Part D Reporting Requirements Technical Specifications should be directed to [email protected] and [email protected], respectively.

Thank you.

Attachment

Frequently Asked Questions (FAQs) Regarding CMS Medicare Parts C & D Measure Data Validation

October 12, 2010

Prepared by:

Centers for Medicare & Medicaid Services

Center for Medicare

Medicare Drug Benefit and C&D Data Group

Table of Contents

General 2

Cost of Data Validation Reviews 3

Scope and Timing of Data Validation Reviews 3

Requirement to Undergo Data Validation 7

Data Validation Requirements for PBMs and Delegated Entities 7

Requirements for Independent Data Validation Contractor 8

Data Validation Processes 9

Data Validation Findings and Follow-Up 11

Data Security 13

General

Q: What is the purpose of the independent data validation?

A: The purpose of the independent data validation is to ensure that Part C and Part D organizations are reporting health and drug plan data that are reliable, valid, complete, comparable, and timely. The validated data will improve reporting and will provide CMS with assurance that data are credible and consistently collected and reported by sponsoring organizations.

Q: How does this independent data validation differ from other CMS audits of Part C and Part D organizations?

A: The data validation reviews will be performed by an independent contractor hired by the sponsoring organization, and the reviews will primarily focus on the accuracy of the reported data and the integrity of the data gathering, compiling, and reporting processes. Program audits are conducted by CMS staff to determine whether or not the program is compliant with statutes, regulations, and policies and meeting programmatic goals. CMS will ensure that that the data validation audits are not duplicative of program audits.

Q: When will the final data validation standards and procedures be released?

A: CMS is targeting a release date of late 2010 for the final version of the data validation standards and procedures. At this time, CMS plans to issue a data validation manual that will contain the final data validation standards and procedures, including the following:

1. Organizational Assessment Instrument

2. Data Extraction and Sampling Instructions

3. Data Validation Standards

4. Interview Discussion Guide

5. Findings Data Collection Form and Instructions

6. Standards for Selecting a Data Validation Contractor

Sponsors and data validation contractors are required to use the CMS issued processes and tools contained in the data validation manual to conduct the review.

Q: Is CMS planning to train sponsoring organizations and potential data validation contractors to ensure consistency with the review process?

A: Yes. In addition to issuing the data validation manual mentioned above, CMS is developing a web-based Data Validation Training for sponsoring organizations and potential data validation contractors. This training is targeted for release in late 2010 and will provide an opportunity for organizations and potential third-party data validation contractors to learn more about the data validation program and its specific requirements.

Q: Who developed the data validation standards and procedures?

A: CMS worked with a contractor to develop the data validation standards and procedures. The draft data validation standards and procedures were released as part of a Paperwork Reduction Act package for public comment in the spring of 2010, and this package is expected to be finalized by late 2010.

Q: Were the data validation standards and procedures tested during development?

A: Yes. The data validation standards and procedures were pilot tested with two organizations (one large Medicare Advantage Organization and one standalone Prescription Drug Plan). The findings from these pilot tests helped to inform changes and improvements to the data validation program.

Q: What were some of the key findings from the data validation pilot tests?

A: CMS plans to issue a summary of lessons learned from the data validation pilot tests in the coming months.

Cost of Data Validation Reviews

Q: Who is responsible for the costs associated with the independent data validation?

A: The sponsoring organization is responsible for acquiring the independent data validation contractor and for all other costs associated with completing the independent data validation and reporting the results to CMS.

Q: What does CMS estimate is the annual cost to the sponsoring organization for the data validation program and how did it develop that estimate?

A: CMS published burden and cost estimates for this program and for contracting with a data validation reviewer as part of the Paperwork Reduction Act package for public comment. CMS estimates the total annual burden for all reviews covering all sponsoring organizations and data validation contractors to be 237,127 hours for a total cost of $17,018,860. For further detail, refer to “Supporting Statement for Paperwork Reduction Act Submissions: Medicare Part C and Part D Data Validation (42 C.F.R. §422.516(g) and §423.514(g)),” dated August 26, 2010.

Scope and Timing of Data Validation Reviews

Q: When will the first data validation reviews be conducted?

A: The first data validation reviews must be conducted between March and May 2011 to retrospectively assess data submitted to CMS by February 28^th, 2011 per the 2010 reporting requirements for Part C and Part D organizations.

Q: How often must data validation reviews be conducted?

A: CMS requires that data validation be conducted once per year during the March-May timeframe. This annual, retrospective review will incorporate all data submitted to CMS by February 28^th based on the previous calendar years’ reporting requirements (see table below).

Q: Which data measures are required to be included in the March-May 2011 data validation?

A: After careful review of the reporting requirements and CMS’ continued data needs, and the determination that the most effective data validation must be completely retrospective, CMS has determined that the first annual data validation (March-May 2011) will include 12 Part C and Part D areas included in the table below.

Part C and Part D Areas Requiring Data Validation in 2011

2010 Measure	Reporting Period(s)	Data Submission Due Date(s) to CMS	Data Validation Findings Due to CMS*
Part C1
Provider Network Adequacy	1/1/10 - 12/31/10	2/28/11	5/31/11
Grievances	1/1/10 - 3/31/10 4/1/10 - 6/30/10 7/1/10 - 9/30/10 10/1/10 - 12/31/10	5/31/10 8/31/10 11/30/10 2/28/11	5/31/11
Organization Determinations/ Reconsiderations	1/1/10 - 3/31/10 4/1/10 - 6/30/10 7/1/10 - 9/30/10 10/1/10 - 12/31/10	5/31/10 8/31/10 11/30/10 2/28/11	5/31/11
Employer Group Plan Sponsors	1/1/10 - 12/31/10	2/28/11	5/31/11
Plan Oversight of Agents	1/1/10 - 12/31/10	2/28/11	5/31/11
Part D2
Retail, Home Infusion, and LTC Pharmacy Access	1/1/10 - 3/31/10 (Sections A&B) 1/1/10 - 12/31/10 (Sections C&D)	5/31/10 (A&B) 2/28/11 (C&D)	5/31/11
Medication Therapy Management Programs	1/1/10 - 12/31/10	2/28/11	5/31/11
Grievances	1/1/10 - 3/31/10 4/1/10 - 6/30/10 7/1/10 - 9/30/10 10/1/10 - 12/31/10	5/15/10 8/15/10 11/15/10 2/15/11	5/31/11
Coverage Determinations and Exceptions	1/1/10 - 3/31/10 4/1/10 - 6/30/10 7/1/10 - 9/30/10 10/1/10 - 12/31/10	5/15/10 8/15/10 11/15/10 2/15/11	5/31/11
Appeals	1/1/10 - 3/31/10 4/1/10 - 6/30/10 7/1/10 - 9/30/10 10/1/10 - 12/31/10	5/15/10 8/15/10 11/15/10 2/15/11	5/31/11
Employer/Union-Sponsored Group Health Plan Sponsors	1/1/10 - 12/31/10	2/28/11	5/31/11
Plan Oversight of Agents	1/1/10 - 12/31/10	2/28/11	5/31/11

¹ The following Part C measures are required for CMS reporting but are not included in the data validation review: PFFS Plan Enrollment Verification Calls and PFFS Provider Payment Dispute Resolution Process.

²The following Part D measures are required for CMS reporting but are not included in the data validation review: Enrollment, Access to Extended Day Supplies at Retail Pharmacies, Prompt Payment, Pharmacy Support of Electronic Prescribing, Pharmacy & Therapeutics (P&T) Committees/Provision of Part D Functions, Pharmaceutical Manufacturer Rebates, Discounts, and Other Price Concessions, Licensure and Solvency, and Fraud, Waste, and Abuse Compliance Programs.

Q: Which data are required to be included in subsequent years’ (post-2011) data validations?

A: CMS is currently planning for the 2012 data validation to include 17 Part C and Part D areas included in the table below. Please note that the 2012 data validation will include not only the 2011 data with a reporting deadline of 2/28/12 or before, but also five selected 2010 areas that were not required to be submitted to CMS in time for the data validation done in 2011. The same methodology applies for the 2013 data validation for the 2012 calendar year’s data. This schedule allows CMS to meet its goal of conducting a completely retrospective data validation for all required data. CMS expects to modify the reporting deadlines for the CY2013 reporting requirements so that all affected measures are reported to CMS prior to the start of the data validation timeframe, and all validations of CY2013 data will be completed in 2014.

Part C and Part D Areas Requiring Data Validation in 2012

2010 Measure	Reporting Period(s)	Data Submission Due Date(s) to CMS	Data Validation Findings Due to CMS*
Part C
Benefit Utilization	1/1/10 - 12/31/10	8/31/11	5/31/12
Procedure Frequency	1/1/10 - 12/31/10	5/31/11	5/31/12
Serious Reportable Adverse Events	1/1/10 - 12/31/10	5/31/11	5/31/12
Special Needs Plans (SNPs) Care Management	1/1/10 - 12/31/10	5/31/11	5/31/12
Part D
Long-Term Care (LTC) Utilization	1/1/10 - 12/31/10	6/30/11	5/31/12
2011 Measure	Reporting Period(s)	Data Submission Due Date(s) to CMS	Data Validation Findings Due to CMS*
Part C
Provider Network Adequacy	1/1/11 - 12/31/11	2/28/12	5/31/12
Grievances	1/1/11 - 3/31/11 4/1/11 - 6/30/11 7/1/11 - 9/30/11 10/1/11 - 12/31/11	5/31/11 8/31/11 11/30/11 2/28/12	5/31/12
Organization Determinations/ Reconsiderations	1/1/11 - 3/31/11 4/1/11 - 6/30/11 7/1/11 - 9/30/11 10/1/11 - 12/31/11	5/31/11 8/31/11 11/30/11 2/28/12	5/31/12
Employer Group Plan Sponsors	1/1/11 - 12/31/11	2/28/12	5/31/12
Plan Oversight of Agents	1/1/11 - 12/31/11	2/28/12	5/31/12

Part C and Part D Areas Requiring Data Validation in 2012 (continued)

2011 Measure	Reporting Period(s)	Data Submission Due Date(s) to CMS	Data Validation Findings Due to CMS*
Part D
Retail, Home Infusion, and LTC Pharmacy Access	1/1/11 - 3/31/11 (Sections A&B) 1/1/11 - 12/31/11 (Sections C&D)	5/31/11 (A&B) 2/28/12 (C&D)	5/31/12
Medication Therapy Management Programs	1/1/11 - 12/31/11	2/28/12	5/31/12
Grievances	1/1/11 - 3/31/11 4/1/11 - 6/30/11 7/1/11 - 9/30/11 10/1/11 - 12/31/11	5/15/11 8/15/11 11/15/11 2/15/12	5/31/12
Coverage Determinations and Exceptions	1/1/11 - 3/31/11 4/1/11 - 6/30/11 7/1/11 - 9/30/11 10/1/11 - 12/31/11	5/15/11 8/15/11 11/15/11 2/15/12	5/31/12
Appeals	1/1/11 - 3/31/11 4/1/11 - 6/30/11 7/1/11 - 9/30/11 10/1/11 - 12/31/11	5/15/11 8/15/11 11/15/11 2/15/12	5/31/12
Employer/Union-Sponsored Group Health Plan Sponsors	1/1/11 - 12/31/11	2/28/12	5/31/12
Plan Oversight of Agents	1/1/11 - 12/31/11	2/28/12	5/31/12

Q: Will the list of measures that are required to be included in each year’s data validation change?

A: CMS is currently planning for an annual full review of all measures included in the data validation. Depending on the results of the first year’s data validation activities, CMS may consider modifying the requirement to validate only a subset of measures in succeeding years.

Q: Will CMS consider moving the March-May timeframe for conducting the data validation, or consider extending the data validation timeframe beyond 3 months?

A: No. CMS requires that data validation be conducted once per year during the March-May timeframe. At this time CMS has no plans to change or extend this timeframe.

Q: Will data validation be required at the contract level or at the parent organization level? In cases where sponsoring organizations have the same systems and processes for all or multiple contracts, can the data validation reviews be conducted at the organization level (vs. the contract level)?

A: The data validation reviews must be conducted at the contract level. CMS believes the contract is the most appropriate “unit of analysis” in conducting this data validation, given that the Part C/D data are generally available at the contract level and that the contract is the basis of any legal and accountability issues concerning the rendering of services. Organizations that hold more than one contract with CMS only need to complete one version of the Organizational Assessment Instrument (OAI) that covers all its contracts, and sampling across multiple contracts is permitted if the processes and systems are the same. However, the data validation contractor must determine and report separate findings for each contract.

Requirement to Undergo Data Validation

Q: Is there an enrollment threshold for the data validation requirement?

A: No. All Part C and Part D organizations that report Part C and/or Part D data per the Reporting Requirements, regardless of enrollment size, are required to undergo a data validation review.

Q: If a plan terminates at the end of a contract, is it still required to have its reporting requirements data validated?

A: If the sponsoring organization still has at least one Part C or Part D contract with CMS, then it is required to validate the data reported to CMS for the last year of any previous, but terminated contract(s).

Q: Are PACE organizations or Part C Health Care Prepayment Plans required to undergo a data validation review?

A: No. PACE organizations and Part C Health Care Prepayment Plans are not required to undergo a data validation review.

Q: Are 1876 Cost Plans required to undergo a data validation review?

A: Yes. CMS requires 1876 Cost Plans to submit reporting requirements data and therefore they must also undergo data validation review for the data that they report.

Q: Will CMS consider staggering the requirement to undergo a data validation review so that only 1/3 of sponsoring organizations undergo the data validation each year?

A: No. The regulation at §422.516(g) and §423.514(g) requires each sponsoring organization to undergo the data validation annually.

Data Validation Requirements for PBMs and Delegated Entities

Q: Can a Pharmacy Benefit Manager (PBM) or other type of delegated entity acquire an independent contractor to conduct the data validation and share its data validation results with the sponsoring organizations with which it contracts, so that these entities do not have to undergo a data validation for each contract?

A: No. Currently CMS will not allow this for the first year of data validation reviews. CMS is exploring this for possible 2012 implementation.

Requirements for Independent Data Validation Contractor

Q: Can sponsoring organizations use their own staff to perform the data validation?

A: No. CMS requires that the data validation be conducted by an independent, external entity. Sponsoring organizations may use their own staff to assist the data validation contractor in obtaining the information, data, and documents needed to complete the data validation review.

Q: Why does CMS require an independent data validation?

A: We believe that only an independent data validation conducted by an external entity will ensure that the data used to develop plan performance measures are credible to other stakeholders, and that information used to respond to Congressional and public inquiries are reliable for monitoring plans.

Q: Who is responsible for acquiring the independent data validation resources?

A: The sponsoring organization will be responsible for acquiring the independent data validation resources.

Q: Does CMS have standards or criteria for hiring a data validation contractor?

A: Yes. The Standards for Selecting a Data Validation Contractor describe the minimum qualifications, credentials, and resources that the selected data validation contractor must possess. The Standards for Selecting a Data Validation Contractor will be included in the data validation manual, which is targeted for release in late 2010.

Q: Will the selected data validation contractors be required to undergo any type of testing or training?

A: Yes. One of the criteria contained in the Standards for Selecting a Data Validation Contractor is the requirement that all data validation contractors take the web-based CMS Data Validation Training at the individual staff level, and that all data validation contractor staff assigned to a data validation team complete the training prior to working on the data validation project. The training will provide each participant with documentation that the training was successfully completed, and the data validation contractor must provide this documentation to any hiring sponsoring organization for all staff assigned to the applicable data validation team before commencing work on the data validation.

Q: How strictly will CMS enforce the data validation contractor standards and training requirement?

A: Sponsoring organizations must document their selection process and be able to show, upon request by CMS, how their chosen data validation contractor meets the minimum qualifications, credentials, and resources described in the Standards for Selecting a Data Validation Contractor.

Q: Will CMS certify qualified data validation contractors or provide a list of potential data validation contractors for sponsoring organizations to choose from?

A: No. CMS has no data validation certification process and does not intend to make a list of potential contractors publicly available. Sponsoring organizations must select an independent data validation contractor that possesses the minimum qualifications, credentials, and resources described in the Standards for Selecting a Data Validation Contractor.

Q: Will CMS allow hiring more than one data validation contractor to handle Part C and Part D data validation and auditing?

A: No. Sponsoring organizations must acquire one data validation contractor to conduct the data validation on reported data. However, the data validation contractor may subcontract in order to ensure it has the expertise required for each data validation area and to meet the minimum qualifications, credentials, and resources described in the Standards for Selecting a Data Validation Contractor.

Q: Can the independent data validation contractor be the same reviewer for pre-assessment review?

A: Yes. Sponsoring organizations may contract with data validation reviewers to perform mock audits, pre-assessments, and any other types of review prior to the formal data validation review that is to be conducted in March - May 2011. Organizations may use the same data validation contractor to perform the organization’s formal review as long as there is no conflict of interest as described in the Organizational Conflict of Interest section of the Standards for Selecting a Data Validation Contractor.

Q: Can a sponsoring organization change its data validation contractor during the formal data validation review that is to be conducted in March-May 2011?

A: A sponsoring organization may not change its data validation contractor during the formal review period unless there are conditions that are unrelated to audit findings such as negligence or malfeasance on the part of the contractor. If a change in contractor is required, the new contractor is required to complete the data validation review in its entirety (starting with the OAI submission through submitting findings to CMS) within the required March - May data validation review timeline. Instructions for notifying CMS of a change to the selected data validation contractor will be included in data validation manual, which is targeted for release in late 2010.

Data Validation Processes

Q: What is the focus of the data validation standards and procedures?

A: The main focus is on how the sponsoring organization collects, stores, and reports data. Standards and procedures also focus on how sponsors follow the applicable Part C and Part D Reporting Requirements Technical Specifications to compile data, take into account appropriate data exclusions, and verify calculations, computer code and algorithms.

Q: Are sponsoring organizations required to complete the Organizational Assessment Instrument (OAI) or is it optional?

A: While completion of the OAI is not mandatory, CMS strongly recommends that organizations complete this document in advance of the data validation reviewer’s on-site visit as the data validation review relies significantly on the information captured in this tool. The completed OAI may reduce required contractor resources, and make the on-site portion of the review more efficient and effective.

Q: How much time will the sponsoring organization have to complete and return the Organizational Assessment Instrument (OAI) to the data validation contractor?

A: CMS estimates that the OAI should take no more than two weeks to complete and should be returned to the data validation reviewer in early March.

Q: The information requested in Sections 3.1 and 3.3 of the OAI is redundant with the information that CMS collects from sponsoring organizations each year. Can these sections be removed so that organizations do not have to complete it twice? Alternatively, could CMS provide an automated process for organizations to retrieve the information and populate these sections?

A: No. Each sponsoring organization must provide its data validation contractor basic information regarding its Medicare contracts and which Part C and/or Part D Reporting Requirement data each contract reports to CMS, as the data validation contractor does not have access in HPMS to where this information is contained.

Q: Will CMS make the OAI document available electronically?

A: Yes. The final versions of all documents associated with the data validation will be available electronically upon their release in the data validation manual in late 2010. Data validation reviewers will send organizations editable, electronic copies of the OAI, and organizations should provide the completed OAI to their selected reviewer electronically as well.

Q: Can a sponsoring organization complete one OAI for all of its contracts included in the data validation?

A: Yes. Organizations that hold more than one contract with CMS only need to complete one version of the OAI that covers all its contracts. If the information provided in the OAI varies by contract, the document allows for the flexibility to identify the differences for the reviewer in applicable sections.

Q: Does CMS require the data validation review to take place onsite at the sponsoring organization’s facility?

A: All data validation reviews must be onsite at the sponsoring organization’s facility, and CMS will not allow exceptions for offsite reviews. However, not all activities associated with the data validation review must be conducted onsite. At a minimum, the data validation contractor must perform the following activities onsite: (1) Conduct interviews with sponsoring organization staff, (2) Observe the organization’s reporting processes, and (3) Obtain census and/or sample files to support validation of Part C and Part D measures.

Data Validation Findings and Follow-Up

Q: What is the process and timing for data validation findings to be reported to CMS? Will the sponsoring organization or the data validation contractor be responsible for this reporting?

A: The data validation contractor is required to report its findings directly to CMS by May 31, 2011. The findings must be entered into the Health Plan Management System (HPMS). Instructions for reporting findings will be included in data validation manual, which is targeted for release in late 2010.

Q: How will the data validation contractor obtain access to HPMS and what information will the contractor have access to?

A: CMS will assign user names and passwords to the contractor’s staff (maximum of 5 individuals) that the sponsoring organization identifies as responsible for reporting the data validation findings in HPMS. These credentials will allow those individuals to access only the HPMS module used for reporting data validation findings and to access only the sponsoring organization(s)/contract(s) with which they are associated. Instructions for requesting access to HPMS will be included in data validation manual, which is targeted for release in late 2010.

Q: What information will the data validation contractor share with CMS?

A: The data validation contractor will report to CMS information that mirrors the Findings Data Collection Form. This includes the review results and/or data sources that were reviewed for each standard or sub-standard, as well as the Yes, No, or Not Applicable finding associated with each standard or sub-standard.

Q: Will the sponsoring organization have access to the HPMS module used for reporting data validation findings?

A: Yes. The sponsoring organization will be required to attest in the HPMS module that it has reviewed the data validation findings that were entered by its selected data validation contractor. The organization will also be able to access reports containing the “pass” or “not pass” score(s) assigned by CMS (see below).

Q: Will the sponsoring organization have the opportunity to review and discuss the data validation findings with its data validation contractor prior to their submission to CMS?

A: This is at the discretion of the sponsoring organization, who should work with its selected data validation contractor to build time into the March-May data validation schedule to allow sufficient review of the Findings Data Collection Form after it is completed by the reviewer and the resolution of any issues prior to the May 31 deadline for submitting findings to CMS.

Q: If a sponsoring organization disagrees with its data validation contractor’s findings, how will that be documented and communicated to CMS?

A: The sponsoring organization will be required to attest in the HPMS module used for reporting data validation findings that it has reviewed the data validation contractor’s findings. However, this attestation does not indicate that the sponsoring organization agrees with the findings. If the organization disagrees with any of the findings, it should use the “comments” field available in the HPMS module to indicate this disagreement to CMS.

Q: Will CMS evaluate sponsoring organizations based on the findings of the data validation?

A: Yes. CMS has developed a scoring methodology for evaluating the data validation findings. Sponsoring organizations will receive a “pass” or “not pass” score based on the findings reported by the independent data validation contractor. CMS will issue more information on this scoring methodology in the coming months.

Q: Will the “pass” or “not pass” determination be assigned at the contract level or at the parent organization level?

A: CMS will make the “pass” or “not pass” determination at the contract level.

Q: How will CMS communicate the “pass” or “not pass” determination to the sponsoring organization?

A: CMS will report the “pass” or “not pass” determination and raw scores to the sponsoring organization via a report issued through the HPMS module used for reporting data validation findings.

Q: Will sponsoring organizations have the right to appeal the “pass” or “not pass” determination of the data validation review?

A: No, the organization will not have the right of appeal.

Q: What are the consequences of a “not pass” determination?

A: Organizations that receive a “not pass” determination for one or more of their contracts could be subject to compliance actions, corrective action plans, or other enforcement actions. CMS will treat a “not pass” determination the same as failure to submit required data, which in turn will be considered non-compliant

Q: Will the results of the data validation reviews be used in the CMS performance ratings?

A: CMS has not determined whether findings from the data validation program will be incorporated into the Star Ratings system. The primary purpose of the data validation program is to ensure that Part C and Part D organizations are reporting health and drug plan data that are reliable, valid, complete, comparable, and timely. The findings and “pass” or “not pass” determinations will not immediately be shared with the public.

Data Security

Q: The data validation requires sponsoring organizations to submit information relevant to the underlying data sources and reporting processes used to calculate each measure as well as programming code/source code. Given that this type of information can be proprietary and confidential, will organizations be scored deficient for not providing this documentation?

A: Yes. Sponsoring organizations must provide the information requested in the OAI for the data validation contractor to review. It is up to the organization and its contractor to work out mutually agreeable methods for sharing and protecting proprietary data. In order to address concerns such as this, the Standards for Selecting a Data Validation Contractor include minimum security requirements with which the contractor’s facility, equipment, and processes must comply.

Q: Some of the census and/or sample files required to support the data validation review contain protected health information. Will CMS establish standard accepted methods for securely transmitting this information to the data validation contractor?

A: No. The sponsoring organization is responsible for ensuring that it has established mutually agreeable methods for sharing protected health information with the reviewer and that the reviewer complies with all HIPAA privacy and security requirements.