CMS-10589_Supporting Statement Part A

Supporting Statement – Part A

QECP Annual Report Workbook Submission Requirement for Qualified Entities under ACA Section 10332

A. Background

Section 10332 of the Patient Protection and Affordable Care Act (ACA) requires the Secretary to make standardized extracts of Medicare claims data under Parts A, B, and D available to “qualified entities” for the evaluation of the performance of providers of services and suppliers. The statute provides the Secretary with discretion to establish criteria to determine whether an entity is qualified to use claims data to evaluate the performance of providers of services and suppliers.

Section 105 of the Medicare Access and Reauthorization Act of 2015 (MACRA) expands how qualified entities will be allowed to use and disclose data under the qualified entity program consistent with other applicable laws, including information, privacy, security, and disclosure laws. This collection focuses on the expansion of qualified entities.This collection covers the requirement that a qualified entity must submit an annual report to CMS. In addition, this collection covers the requirement that a qualified entity must have a qualified entity data use agreement (QE DUA) or non-public analyses agreement in place with an authorized user prior to providing or selling data or analyses to that authorized user.

B. Justification

1 . Need and Legal Basis

The Patient Protection and Affordable Care Act (ACA) was enacted on March 23, 2010 (Pub. L. 111-148). ACA amends section 1874 of the Social Security Act by adding a new subsection (e) to make standardized extracts of Medicare claims data under Parts A, B, and D available to qualified entities to evaluate the performance of providers of services and suppliers. It also provides for annual reporting requirements. The qualified entity annual report must be completed annually, as required by the program’s Final Rule (42 CFR Part 401, Subpart G, Section 719).

Section 105 of MACRA provides for additional annual reporting requirements if a qualified entity chooses to provide or sell analyses and/or data to authorized users. It also requires a qualified entity to enter into a data use agreement or non-public analyses agreement with an authorized user prior to providing or selling data or selling a non-public analyses.

2. Information Users

The information from the collection will be used by CMS to determine whether a qualified entity continues to meet the qualified entity certification requirements under section 10332 of the Affordable Care Act and Section 105 of MACRA. In addition, it will ensure that certain privacy and security requirements are met when qualified entities provide or sell data or sell non-public analyses that contains individually identifiable beneficiary information to authorized users.

3. Use of Information Technology

We anticipate that all annual reports will be submitted electronically.

4. Duplication of Efforts

This information collection does not duplicate any other effort and the information cannot be obtained from any other source.

5. Small Businesses

No special considerations are given to small businesses. The same information is needed to assess the qualifications of all organizations.

6. Less Frequent Collection

Data are collected once at the time of annual report as required by statute.

There is no requirement around the frequency of the collection for the QE DUA or non-public analyses agreement other than a QE must execute either a QE DUA or non-public analyses agreement with an authorized user prior to providing or selling data or analyses to that authorized user.

7. Special Circumstances

No special circumstances.

8. Federal Register/Outside Consultation

Public input on how CMS might implement the requirements of ACA section 10332 was sought in an Open Door Forum listening session on September 20, 2010. Using this input, a Notice of Proposed Rule Making (NPRM) was drafted and published in the Federal Register, which proposed to amend 42 CFR, Chapter IV, Part 401 by adding Subpart G – Availability of Medicare Data for Performance Measurement [76 Fed. Reg. 33566-33588 (June 8, 2011)] The NPRM included a description of the proposed information collection requirements. CMS received no specific comments on the proposed information collection requirements. The final implementing regulations (76 FR 76542) became effective on January 6, 2012.

• The NPRPM for the expansion of the QE program published on February 2, 2016 (81 FR 5397).

9. Payments/Gifts to Respondents

There are no payments/gifts to respondents.

10. Confidentiality

We pledge privacy to the extent allowed by law. The applications will be kept secure. No proprietary data or information will be disclosed outside the Government and will not be duplicated, used, or disclosed – in whole or in part – for any purpose other than to evaluate the application. Files containing the applications or information from these forms will be safeguarded in accordance with Departmental standards and National Institute of Standards and Technology (NIST) Special Publication 800-53, Recommended Security Controls for Federal Information Systems and Organizations which limits access to only authorized personnel. The safeguards shall provide a level of security as required by Office of Management and Budget (OMB) Circular No. A-130 (revised), Appendix III – Security of Federal Automated Information Systems.

11. Sensitive Questions

No sensitive questions are part of this information collection.

12. Burden Estimates (Hours & Wages)

Proposed §401.718(c) and §401.716(b)(2)(ii) require a qualified entity to enter into a QE DUA with an authorized user prior to providing or selling data or selling a non-public analyses that contains individually identifiable beneficiary information. Proposed §401.713(d) requires specific provisions in the QE DUA. Proposed §401.716(c) requires a qualified entity to enter into a non-public analyses agreement with the authorized user as a pre-condition to providing or selling de-identified analyses. We estimate that it will take each qualified entity a total of 40 hours to develop the QE DUA and non-public analyses agreement. Of the 40 hours, we estimate it will take a professional/technical services employee with an hourly labor cost of $75.08 a total of 20 hours to develop both the QE DUA and non-public analyses agreementand estimate that it will require a total of 20 hours of legal review at an hourly labor cost of $77.16 for both the QE DUA and non-public analyses agreement. We also estimate that it will take each qualified entity 2 hours to process and maintain each QE DUA or non-public analyses agreement with an authorized user by a professional/technical service employee with an hourly labor cost of $75.08. While there may be two different staff positions that perform these duties (one that is reposible for processing the QE DUAs and/or non-public analyses agreement and one that is responsible for maintaining the QE DUA and/or non-public analyses agreement), we believe that both positions would fall under the professional/technical services employee labor category with an hourly labor cost of $75.08. This would mean that to develop each QE DUA and non-public analysis agreement, the burden cost per qualified entity would be $3,045 with a total estimated burden for all 15 qualified entities of $45,675. This does not include the two hours to process and maintain each QE DUA.

As discussed in the regulatory impact analysis below, we estimate that each qualified entity would need to process and maintain 70 QE DUAs or non-public analyses agreements as some authorized users may receive both datasets and a non-public analyses and would only need to execute one QE DUA. We estimate that it will take each qualified entity 2 hours to process and maintain each QE DUA or non-public analyses agreement. This would mean the burden cost per qualified entity to process and maintain 70 QE DUAs or non-public analyses agreements would be $10,511 with a total estimated burden for all 15 qualified entities of $157, 668. While we anticipate that the requirement to create a QE DUA and/or non-public analyses agreement will only be incurred once by a qualified entity, we believe that the requirement to process and maintain the QE DUAs and/or non-public analyses will be an ongoing cost. We request comment on the number of hours that will be needed to create and process the QE DUA and non-public analyses agreement.

If finalized, these regulations would also require a qualified entity to submit additional information as part of its annual report to CMS. A qualified entity is currently required to submit an annual report to CMS under §401.719(b). Proposed §401.719(b)(3) and (4) provide for additional reporting requirements if a qualified entity chooses to provide or sell analyses and/or data to authorized users. The burden associated with this requirement is the time and effort necessary to gather, process, and submit the required information to CMS. There are currently 13 qualified entities; however we estimate that number will increase to 20 if these proposals are finalized. Some qualified entities may not want to bear the risk of the potential assessments and have been able to accomplish their program goals under other CMS data sharing programs, therefore some qualified entities may not elect to provide or sell analyses and/or data to authorized users. As a result, we estimate that 15 qualified entities will choose to provide or sell analyses and/or data to authorized users, and therefore, would be required to comply with these additional reporting requirements within the first three years of the program. We further estimate that it would take each qualified entity 50 hours to gather, process, and submit the required information. We estimate that it will take each qualified entity 34 hours to gather the required information, 15 hours to process the information, and 1 hour to submit the information to CMS. We believe a professional or technical services employee of the qualified entity with an hourly labor cost of $75.08 will fulfill these additional annual report requirements. We estimate that 15 qualified entities will need to comply with this requirement and that the total estimated burden associated with this requirement is $56,310. We request comment on the type of employee and the number of hours that will be needed to fulfill these additional annual reporting requirements.

As a reminder, the final rule for the qualified entity program, published December 7, 2011, included information about the burden associated with the provisions in that rule. Specifically, Sections 401.705-401.709 provide the application and reapplication requirements for qualified entities. The burden associated with these requirements is currently approved under OMB control number 0938-1144 with an expiration date of May 31, 2018. This package accounts for 35 responses. Section 401.713(a) states that as part of the application review and approval process, a qualified entity would be required to execute a DUA with CMS, that among other things, reaffirms the statutory bar on the use of Medicare data for purposes other than those referenced above. The burden associated with executing this DUA is currently approved under OMB control number 0938-0734 with an expiration date of December 31, 2017. This package accounts for 9,240 responses (this package covers all CMS DUAs, not only DUAs under the qualified entity program). We currently have 13 qualified entities and estimate it will increase to 20 so we have not surpassed the previously approved numbers.

We based the hourly labor costs on those reported by the Bureau of Labor Statistics (BLS) at http://data.bls.gov/pdq/querytool.jsp?survey=ce for this labor category. We used the annual rate for 2014 and added 100 percent for overhead and fringe benefit costs.

Table 1: Collection of Information

Regulation Section(s)	OMB Control No.	Number of Respondents	Number of Responses per respondent	Burden per Response (hours)	Total Annual Burden (hours)	Hourly Labor Cost of Reporting ($)*	Total Labor Cost of Reporting ($)	Total Cost ($)
§401.718, §401.716, and §401.713 (DUA and non-public analyses agreement Development)	0938 New	15	1	20	300	75.08	22,524	22,524
§401.718 and §401.716 (Legal Review)	0938 New	15	1	20	300	77.16	23,148	23,148
§401.718 and §401.716 (Processing and Maintenance)	0938 New	15	70	2	2,100	75.08	157,668	157,668
§401.719(b)	0938 New	15	1	50	750	75.08	56,310	56,310
Total		15	73		3,450			259,650

*The values listed are based on 100 percent overhead and fringe benefit calculations.

Note: There are no capital/maintenance costs associated with the information collection requirements contained in this rule; therefore, we have removed the associated column from Table 1.

13. Capital Costs

There are no capital costs associated with the annual report or the QE DUA or non-public analyses agreement.

14. Cost to Federal Government

It is estimated that CMS costs for managing the information collection will include one-eighth full time equivalent at the GS-13 step 4 level with an annual fully loaded salary of $99,905 and $194,000 in contractor support, for a total of $206,488.

15. Changes to Burden

This is a new information collection request.

16. Publication/Tabulation Dates

There are no publication/tabulation dates associated with this collection.

17. Expiration Date

CMS will display the expiration date as indicated.

18. Certification Statement

There are no exceptions to the certification statement.

7