CMS-10589.Supporting Statement Part A - FINAL (1-9-17)

Supporting Statement – Part A

QECP Annual Report Workbook Submission Requirement for Qualified Entities under ACA Section 10332

Background

Section 10332 of the Patient Protection and Affordable Care Act (ACA) requires the Secretary to make standardized extracts of Medicare claims data under Parts A, B, and D available to “qualified entities” for the evaluation of the performance of providers of services and suppliers. The statute provides the Secretary with discretion to establish criteria to determine whether an entity is qualified to use claims data to evaluate the performance of providers of services and suppliers.

Section 105 of the Medicare Access and Reauthorization Act of 2015 (MACRA) expands how qualified entities will be allowed to use and disclose data under the qualified entity program consistent with other applicable laws, including information, privacy, security, and disclosure laws. This collection focuses on the expansion of qualified entities. This collection covers the requirement that a qualified entity must submit an annual report to CMS. In addition, this collection covers the requirement that a qualified entity must have a qualified entity data use agreement (QE DUA) or non-public analyses agreement in place with an authorized user prior to providing or selling data or analyses to that authorized user.

A. Justification

1 . Need and Legal Basis

The Patient Protection and Affordable Care Act (ACA) was enacted on March 23, 2010 (Pub. L. 111-148). ACA amends section 1874 of the Social Security Act by adding a new subsection (e) to make standardized extracts of Medicare claims data under Parts A, B, and D available to qualified entities to evaluate the performance of providers of services and suppliers. It also provides for annual reporting requirements. The qualified entity annual report must be completed annually, as required by the program’s Final Rule (42 CFR Part 401, Subpart G, Section 719).

Section 105 of MACRA provides for additional annual reporting requirements if a qualified entity chooses to provide or sell analyses and/or data to authorized users. It also requires a qualified entity to enter into a data use agreement or non-public analyses agreement with an authorized user prior to providing or selling data or selling a non-public analyses.

2. Information Users

The information from the collection will be used by CMS to determine whether a qualified entity continues to meet the qualified entity certification requirements under section 10332 of the Affordable Care Act and Section 105 of MACRA. In addition, it will ensure that certain privacy and security requirements are met when qualified entities provide or sell data or sell non-public analyses that contains individually identifiable beneficiary information to authorized users.

3. Use of Information Technology

Annual reports currently are submitted electronically. With recent upgrades to our applicant portal, we are exploring additional enhancements such as a web-based solution but do not have a timeline for implementation.

The QE DUA and non-public analyses agreement may be collected electronically but there is no requirement on the qualified entity on how they collect these from the authorized users.

4. Duplication of Efforts

This information collection does not duplicate any other effort and the information cannot be obtained from any other source.

5. Small Businesses

No special considerations are given to small businesses. The same information is needed to assess the qualifications of all organizations.

6. Less Frequent Collection

Data are collected once at the time of annual report as required by statute.

There is no requirement around the frequency of the collection for the QE DUA or non-public analyses agreement other than a QE must execute either a QE DUA or non-public analyses agreement with an authorized user prior to providing or selling data or analyses to that authorized user. Such agreements are created on an as-needed basis.

7. Special Circumstances

No special circumstances.

8. Federal Register/Outside Consultation

Public input on how CMS might implement the requirements of ACA section 10332 was sought in an Open Door Forum listening session on September 20, 2010. Using this input, a Notice of Proposed Rule Making (NPRM) was drafted and published in the Federal Register, which proposed to amend 42 CFR, Chapter IV, Part 401 by adding Subpart G – Availability of Medicare Data for Performance Measurement [76 Fed. Reg. 33566-33588 (June 8, 2011)] The NPRM included a description of the proposed information collection requirements. CMS received no specific comments on the proposed information collection requirements. The final implementing regulations (76 FR 76542) became effective on January 6, 2012.

In the February 2, 2016 Federal Register (81 FR 5397), we published the proposed rule entitled, “Expanding Uses of Medicare Data by Qualified Entities.” We provided a 60-day public comment period. In the proposed rule, to implement the new statutory provisions of section 105 of MACRA, we proposed to amend and make conforming changes to part 401 subpart G, “Availability of Medicare Data for Performance Measurement.” We received approximately 50 comments on the proposed rule from a wide variety of individuals and organizations and we received a few comments on the collection of information requirements.

Comment: One commenter suggested that it would take each organization 75 hours to prepare an application to become a qualified entity, not the 50 hours that CMS estimated in Table 1 of the proposed rule. In addition, the commenter urged CMS to examine the qualified entity application requirements to reduce qualified entity burden.

Response: We appreciate the commenter’s feedback and wish to clarify that the 50 hours in Table 1 refers to the burden associated with the annual report requirements in §401.719(b) and not the burden associated with the qualified entity application. The final rule for the qualified entity program, published December 7, 2011, included information about the burden associated with the provisions in that rule. Specifically, Sections 401.705-401.709 provide the application and reapplication requirements for qualified entities. The burden associated with these requirements is currently approved under OMB control number 0938-1144 with an expiration date of May 31, 2018.

Comment: One commenter suggested that it would take each qualified entity an estimated 60 hours to develop and review the QE DUA and non-public analyses agreement. Of those 60 hours, 30 hours would be to develop the QE DUA and non-public analyses agreement and 30 would be needed for legal review. In addition, the commenter estimated that it would take each qualified entity 3 hours to process and maintain each QE DUA and non-public analyses agreement.

Response: In the proposed rule, we estimated that it would take each qualified entity 40 hours to develop and review the QE DUA and non-public analyses agreement. Of those 40 hours, 20 hours would be needed to develop the QE DUA and non-public analyses agreement and 20 hours would be needed for legal review. We also estimated that it would take 2 hours to process and maintain each QE DUA and non-public analyses agreement. We recognize that some qualified entities may spend more hours than other qualified entities to develop, process, and maintain QE DUAs and non-public analyses agreements. For example, some qualified entities may spend 60 hours to develop the QE DUA and non-public analyses agreement and other qualified entities will spend 30 hours. However, we believe that 40 hours to develop the QE DUA and the non-public analyses agreement and 2 hours to process each QE DUA and the non-public analyses agreement is a reasonable average.

The final rule published on July 7, 2016 (81 FR 44456-44482; RIN 0938—AS66).

9. Payments/Gifts to Respondents

There are no payments/gifts to respondents.

10. Confidentiality

We pledge privacy to the extent allowed by law. The applications will be kept secure. No proprietary data or information will be disclosed outside the Government and will not be duplicated, used, or disclosed – in whole or in part – for any purpose other than to evaluate the application. Files containing the applications or information from these forms will be safeguarded in accordance with Departmental standards and National Institute of Standards and Technology (NIST) Special Publication 800-53, Recommended Security Controls for Federal Information Systems and Organizations which limits access to only authorized personnel. The safeguards shall provide a level of security as required by Office of Management and Budget (OMB) Circular No. A-130 (revised), Appendix III – Security of Federal Automated Information Systems.

11. Sensitive Questions

No sensitive questions are part of this information collection.

12. Burden Estimates (Hours & Wages)

Sections §401.718(c) and §401.716(b)(2)(ii) require a qualified entity to enter into a QE DUA with an authorized user prior to providing or selling data or selling a non-public analyses that contains individually identifiable beneficiary information. §401.713(d) requires specific provisions in the QE DUA. §401.716(c) requires a qualified entity to enter into a non-public analyses agreement with the authorized user as a pre-condition to providing or selling de-identified analyses. We estimate that it will take each qualified entity a total of 40 hours to develop the QE DUA and non-public analyses agreement. Of the 40 hours, we estimate it will take a professional/technical services employee with an hourly labor cost of $75.08 a total of 20 hours to develop both the QE DUA and non-public analyses agreement and estimate that it will require a total of 20 hours of legal review at an hourly labor cost of $77.16 for both the QE DUA and non-public analyses agreement. We also estimate that it will take each qualified entity 2 hours to process and maintain each QE DUA or non-public analyses agreement with an authorized user by a professional/technical service employee with an hourly labor cost of $75.08. While there may be two different staff positions that perform these duties (one that is responsible for processing the QE DUAs and/or non-public analyses agreement and one that is responsible for maintaining the QE DUA and/or non-public analyses agreement), we believe that both positions would fall under the professional/technical services employee labor category with an hourly labor cost of $75.08. This would mean that to develop each QE DUA and non-public analysis agreement, the burden cost per qualified entity would be $3,045 with a total estimated burden for all 15 qualified entities of $45,675. This does not include the two hours to process and maintain each QE DUA.

We estimate that each qualified entity would need to process and maintain 70 QE DUAs or non-public analyses agreements as some authorized users may receive both datasets and a non-public analyses and would only need to execute one QE DUA. We estimate that it will take each qualified entity 2 hours to process and maintain each QE DUA or non-public analyses agreement. This would mean the burden cost per qualified entity to process and maintain 70 QE DUAs or non-public analyses agreements would be $10,511 with a total estimated burden for all 15 qualified entities of $157, 668. While we anticipate that the requirement to create a QE DUA and/or non-public analyses agreement will only be incurred once by a qualified entity, we believe that the requirement to process and maintain the QE DUAs and/or non-public analyses will be an ongoing cost. A qualified entity is required to submit an annual report to CMS under §401.719(b). §401.719(b)(3) and (4) provide for additional reporting requirements if a qualified entity chooses to provide or sell analyses and/or data to authorized users. The burden associated with this requirement is the time and effort necessary to gather, process, and submit the required information to CMS. There are currently 13 qualified entities; however we estimate that number will increase to 20.. Some qualified entities may not want to bear the risk of the potential assessments and have been able to accomplish their program goals under other CMS data sharing programs, therefore some qualified entities may not elect to provide or sell analyses and/or data to authorized users. As a result, we estimate that 15 qualified entities will choose to provide or sell analyses and/or data to authorized users, and therefore, would be required to comply with these additional reporting requirements within the first three years of the program. We further estimate that it would take each qualified entity 50 hours to gather, process, and submit the required information. We estimate that it will take each qualified entity 34 hours to gather the required information, 15 hours to process the information, and 1 hour to submit the information to CMS. We believe a professional or technical services employee of the qualified entity with an hourly labor cost of $75.08 will fulfill these additional annual report requirements. We estimate that 15 qualified entities will need to comply with this requirement and that the total estimated burden associated with this requirement is $56,310. We based the hourly labor costs on those reported by the Bureau of Labor Statistics (BLS) at http://data.bls.gov/pdq/querytool.jsp?survey=ce for this labor category. We used the annual rate for 2014 and added 100 percent for overhead and fringe benefit costs.

Table 1: Collection of Information

Regulation Section(s)	OMB Control No.	Number of Respondents	Number of Responses per respondent	Burden per Response (hours)	Total Annual Burden (hours)	Hourly Labor Cost of Reporting ($)*	Total Labor Cost of Reporting ($)	Total Cost ($)
§401.718, §401.716, and §401.713 (DUA and non-public analyses agreement Development)	0938 New	15	1	20	300	75.08	22,524	22,524
§401.718 and §401.716 (Legal Review)	0938 New	15	1	20	300	77.16	23,148	23,148
§401.718 and §401.716 (Processing and Maintenance)	0938 New	15	70	2	2,100	75.08	157,668	157,668
§401.719(b)	0938 New	15	1	50	750	75.08	56,310	56,310
Total		15	73		3,450			259,650

*The values listed are based on 100 percent overhead and fringe benefit calculations.

Note: There are no capital/maintenance costs associated with the information collection requirements contained in this rule; therefore, we have removed the associated column from Table 1.

13. Capital Costs

There are no capital costs associated with the annual report or the QE DUA or non-public analyses agreement.

14. Cost to Federal Government

It is estimated that CMS costs for managing the information collection will include one-eighth full time equivalent at the GS-13 step 4 level with an annual fully loaded salary of $99,905 and $194,000 in contractor support, for a total of $206,488.

15. Changes to Burden

This is a new information collection request.

16. Publication/Tabulation Dates

There are no publication/tabulation dates associated with this collection.

17. Expiration Date

CMS will display the expiration date as indicated.

18. Certification Statement

There are no exceptions to the certification statement.

6