Form CMS-10394 Application

Application to Be a Qualified Entity to Receive Medicare Data for Performance Measurement (CMS-10394)

PaperBased_Application_Form_09292016

Application and Re-application processes

OMB: 0938-1144

⚠️ Notice: This form may be outdated. More recent filings and information on OMB 0938-1144 can be found here:

Document [pdf]

Download: pdf | pdf

APPENDIX C: PAPER-BASED QE APPLICATION FORM
PRA Disclosure Statement
According to the Paperwork Reduction Act of 1995, no persons are required to respond to a
collection of information unless it displays a valid OMB control number. The valid OMB control
number for this information collection is 0938-1144. The time required to complete this
information collection is estimated to average 500 hours per response, including the time to
review instructions, search existing data resources, gather the data needed, and complete and
review the information collection. If you have comments concerning the accuracy of the time
estimate(s) or suggestions for improving this form, please write to: CMS, 7500 Security
Boulevard, Attn: PRA Reports Clearance Officer, Mail Stop C4-26-05, Baltimore, Maryland 212441850. Please do not send applications, claims, payments, medical records or any documents
containing sensitive information to the PRA Reports Clearance Office. Please note that any
correspondence not pertaining to the information collection burden approved under the
associated OMB control number listed on this form will not be reviewed, forwarded, or
retained. If you have questions or concerns regarding where to submit your documents, please
contact [email protected].

Instructions
Submit the completed QE application form and supporting documents electronically to:
[email protected]. Submit any questions to: [email protected].

Date Application
Submitted

Department of Health & Human Services
Centers for Medicare & Medicaid Services

Date Application
Received by CMS

C-1
CMS#10394 (0938-1144) Exp. XX/XX/XXXX

Section 1: General Information
Instructions: Please input the applicant’s information. The listed trade name and type of
applicant should be for the lead applicant. Subcontractors or partners for this effort should be
listed in the Member Organizations field.
Applicant’s Trade Name/DBA
Type of Applicant
Profit Organization
Non-Profit Organization
Other (describe)
Applicant’s Employer ID Number
Name(s) of Contractor(s) or Member
Organization(s)
(Contact [email protected]
to obtain further instructions to submit
required contractor or member
organization information)

Data Recipient’s Name
Data Requested
Regional (specify States)
National

Department of Health & Human Services
Centers for Medicare & Medicaid Services

C-2
CMS#10394 (0938-1144) Exp. XX/XX/XXXX

Section 2: Mailing Address
Instructions: The mailing address should be an address where mail correspondence about the
application or program can be delivered.
Street Mailing Address __________________________________________________________
Suite/Mail Stop ________________________________________________________________
City _____________________________________ State ____________ ZIP Code ___________
Phone _______________________________________ Fax _____________________________
Website ______________________________________________________________________

Department of Health & Human Services
Centers for Medicare & Medicaid Services

C-3
CMS#10394 (0938-1144) Exp. XX/XX/XXXX

Section 3: Contact Information
Chief Executive Officer (or other equivalent executive)
Instructions: Please provide the contact information for the CEO, or equivalent executive, who
has the authority to oversee the entity’s application and QECP responsibilities.
Prefix _______
First Name____________________________________________________________________
Middle Initial ______
Last Name____________________________________________________________________
Degree ____________________
E-mail Address _________________________________________________________________
Street Mailing Address ___________________________________________________________
Suite/Mail Stop ________________________________________________________________
City _____________________________________ State ____________ ZIP Code ___________
Phone _______________________________________ Fax _____________________________
Point of Contact for Application
Instructions: Please provide the contact information for the individual who will be the primary
contact for day-to-day application and program correspondence.
Prefix _______
First Name____________________________________________________________________
Middle Initial ______
Last Name____________________________________________________________________
Degree ____________________
E-mail Address _________________________________________________________________
Street Mailing Address ___________________________________________________________
Suite/Mail Stop _________________________________________________________________
City _____________________________________ State ____________ ZIP Code ___________
Phone _______________________________________ Fax _____________________________

Department of Health & Human Services
Centers for Medicare & Medicaid Services

C-4
CMS#10394 (0938-1144) Exp. XX/XX/XXXX

Section 4: Standards
Instructions: Please indicate whether the entity is capable of supplying information with regard
to each element by checking the appropriate box (Yes, No, N/A). Using plain language, please
provide explanations in the “explanation of self-assessment” comment box.
Entities are required to submit supporting documentation to support their self-assessment and
for the purposes of the minimum requirements review and assessment. Please list the name of
the supporting document, its relevance to the element, and the pages within the document that
prove such relevance. Additional supporting documentation may be listed in Section 6 of this
application form. Refer to the QECP Operations Manual for complete program information,
including “example documentation” descriptions and “evidence must include” instructions.
Note: Qualified Clinical Data Registries (QCDRs) must meet the QECP requirements with the
exception of Elements 1E and 2A and, in certain cases, all standards and elements associated with
Phase 3 (Element 2B and Standards 4-8). Quasi QEs are not required to submit evidence for Phase
3 if they only intend to publicly report measures that were included in the QCDR self-nomination
process and the measures are calculated from a combined data set of CMS claims and clinical
data sources. In order to receive this Phase 3 evidence exemption, quasi QEs must submit a list of
measures that they intend to publicly report. This list will be reviewed to verify that each measure
was included in the quasi QE’s QCDR self-nomination process and that the measure can be
calculated using combined data.

Department of Health & Human Services
Centers for Medicare & Medicaid Services

C-5
CMS#10394 (0938-1144) Exp. XX/XX/XXXX

STANDARD 1: ENTITY PROFILE
Intent: The entity must provide information about its organization and structure, the types of
providers it intends to evaluate, the geographic areas for which it intends to report data, and its
ability to meet the financial requirements of the program.
Element 1A: Define entity organization
Self assessment:

Assessment:
The entity is a legally recognized “lead” and accountable to CMS for the receipt
of QE Medicare data, with clear contractual relationships identified and
documented between contractors or member organizations, if applicable, that
make it possible for the entity to meet the QECP standards.

Yes
No

Explanation of Self-assessment:

Evidence Must Include:
1. QECP Letter of Commitment Form, containing:
a. Commitment to CMS signed by a member of the lead QE’s executive team
b. Completed proposed timeline to public reporting
c. Completed contractual relationship attestation (if applicable), which includes
attestation of breach of contract liability between parties with potential to collect
damages for failure to perform
d. Completed CMS Quality Improvement Organization attestation, if applicable
2. Descriptive information about the entity (e.g., mission, services offered, primary business
function)
3. Description of unit responsible for performance reporting
4. Description of business model
5. Incorporation and, if applicable, licensure for entity
6. Incorporation and, if applicable, licensure for contractors or member organizations
supporting entity’s QECP activities
7. For entities applying to be quasi QEs, documentation demonstrating active QCDR status.

Department of Health & Human Services
Centers for Medicare & Medicaid Services

C-6
CMS#10394 (0938-1144) Exp. XX/XX/XXXX

Supporting Documentation:
Supporting documentation must include a completed QECP Letter of Commitment with a signed
letter, proposed timeline, Contractual Relationship Attestation and CMS Quality Improvement
Organization (QIO) Attestation (where applicable).
Document 1
Document Name: ___________________________________________________________
Document Relevance: ________________________________________________________
Relevant Pages: _____________________________________________________________
Document 2
Document Name: ___________________________________________________________
Document Relevance: ________________________________________________________
Relevant Pages: _____________________________________________________________
Document 3
Document Name: ___________________________________________________________
Document Relevance: ________________________________________________________
Relevant Pages: _____________________________________________________________

Department of Health & Human Services
Centers for Medicare & Medicaid Services

C-7
CMS#10394 (0938-1144) Exp. XX/XX/XXXX

Element 1B: Show ability to cover the costs of performing the required functions of a
qualified entity
Self Assessment:
assessment:
The entity’s business model is projected to cover the cost of public reporting,
including both the cost of the data and the cost of developing the reports.

Yes
No

Explanation of Self-assessment:

Evidence Must Include:
Executive review and signature on financial documents.
Note: Evidence must come from the entity, not from a contractor or member organization.
Supporting Documentation:
Document 1
Document Name: ___________________________________________________________
Document Relevance: ________________________________________________________
Relevant Pages: _____________________________________________________________
Document 2
Document Name: ___________________________________________________________
Document Relevance: ________________________________________________________
Relevant Pages: _____________________________________________________________
Document 3
Document Name: ___________________________________________________________
Document Relevance: ________________________________________________________
Relevant Pages: _____________________________________________________________

Department of Health & Human Services
Centers for Medicare & Medicaid Services

C-8
CMS#10394 (0938-1144) Exp. XX/XX/XXXX

Element 1C: Identify the geographic areas that entity’s reports will cover
Self assessment:

Assessment:
The entity defines the geographic area(s) for which performance reporting will
incorporate QE Medicare data.

Yes
No

Explanation of Self-assessment:

Evidence Must Include:
1. Data request.
a. Description of geographic area(s) by state for which the entity requests QE Medicare
data.
b. Explicit statement for a 5% national sample, if applicable.
 Note: If requested, a justification for the request must be included.
2. Geographic areas the entity’s report(s) will cover.
a. Note: If reporting on an area smaller than a state (e.g., ZIP code, MSA, or county), list
the areas by state.
Supporting Documentation:
Document 1
Document Name: ___________________________________________________________
Document Relevance: ________________________________________________________
Relevant Pages: _____________________________________________________________
Document 2
Document Name: ___________________________________________________________
Document Relevance: ________________________________________________________
Relevant Pages: _____________________________________________________________
Document 3
Document Name: ___________________________________________________________
Document Relevance: ________________________________________________________
Relevant Pages: _____________________________________________________________

Department of Health & Human Services
Centers for Medicare & Medicaid Services

C-9
CMS#10394 (0938-1144) Exp. XX/XX/XXXX

Element 1D: Identify the types of providers whose performance the entity intends to assess
using QE Medicare data
Self Assessment:
assessment:
The entity lists the types of providers by geographic region for which it intends
to evaluate performance using QE Medicare and other claims data.

Yes
No

Explanation of Self-assessment:

Evidence Must Include:
1. List of providers for which the entity intends to combine other-payer claims data with QE
Medicare data. Please list providers by the geographic area where the entity has access to
other sources of claims data.
a. Note: The types of providers must be those that submit claims and are paid for
Medicare‐covered services and for which the entity has at least one additional source
of claims data.
b. The following is a list of possible provider types.
i. Individual Clinician
ii. Clinic
iii. Group/Practice
iv. Team
v. Facility
vi. Health Plan-Defined Group of Physicians
vii. Integrated Delivery System
Supporting Documentation:
Document 1
Document Name: ___________________________________________________________
Document Relevance: ________________________________________________________
Relevant Pages: _____________________________________________________________
Document 2
Document Name: ___________________________________________________________
Document Relevance: ________________________________________________________
Relevant Pages: _____________________________________________________________

Department of Health & Human Services
Centers for Medicare & Medicaid Services

C-10
CMS#10394 (0938-1144) Exp. XX/XX/XXXX

Element 1E: Demonstrate experience combining claims data, measurement and attribution,
verification, corrections process, and public reporting
Self Assessment:
assessment:
The entity generally must demonstrate three or more years of experience in
Yes
combining claims data, accurately calculating measures, verifying data, using a
No
corrections process, and public reporting.
Explanation of Self-assessment:

Evidence Must Include:
Documents demonstrating experience, generally three or more years, in the following areas:
1. Combining claims data
2. Attribution of patient services and episodes
3. Statistical validity – quality measures
4. Statistical validity – effiency or resource use measures
5. Risk adjustment
6. Outliers
7. Defining comparison groups
8. Verification process
9. Improve public reporting
10. Corrections process
Note: Evidence of experience submitted by the lead entity may be the demonstrated experience
of the entity, the entity’s staff, the entity’s contractor, or, if the entity is a collaborative, the
demonstrated experience of any member organization of the collaborative.
Supporting Documentation:
Document 1
Document Name: ___________________________________________________________
Document Relevance: ________________________________________________________
Relevant Pages: _____________________________________________________________
Document 2
Document Name: ___________________________________________________________
Document Relevance: ________________________________________________________
Relevant Pages: _____________________________________________________________

Department of Health & Human Services
Centers for Medicare & Medicaid Services

C-11
CMS#10394 (0938-1144) Exp. XX/XX/XXXX

STANDARD 2: DATA SOURCES
Intent: The entity must provide evidence of the ability to combine claims data from other sources
to calculate performance reports.
Element 2A: Show ability to obtain claims data from at least one other-payer source to
combine with QE Medicare data
Self Assessment:
assessment:
For the geographic areas identified in Element 1C and for providers identified in
Element 1D, entity possesses claims data from at least one other source;
however, data from two or more sources is preferable.

Yes
No
N/A

Explanation of Self-assessment:

Evidence Must Include:
1. Completed QECP Data Source Attestation Form, containing:
a. Provider reporting profile
i. Total number of covered lives in geographic reporting area
ii. Total number of covered lives included in all other-payer claims data sources (by
state if reporting nationally)
b. Data supplier profile
c. Data detail
i. Volume of data
ii. Geographic coverage of data
iii. Provider types
2. A description of how the data they do have for use in the QE program will be adequate to
address the concerns about small sample size and reliability.

Department of Health & Human Services
Centers for Medicare & Medicaid Services

C-12
CMS#10394 (0938-1144) Exp. XX/XX/XXXX

Supporting Documentation:
Supporting documentation must include a completed QECP Data Source Attestation Form.
Document 1
Document Name: ___________________________________________________________
Document Relevance: ________________________________________________________
Relevant Pages: _____________________________________________________________
Document 2
Document Name: ___________________________________________________________
Document Relevance: ________________________________________________________
Relevant Pages: _____________________________________________________________
Document 3
Document Name: ___________________________________________________________
Document Relevance: ________________________________________________________
Relevant Pages: _____________________________________________________________

Department of Health & Human Services
Centers for Medicare & Medicaid Services

C-13
CMS#10394 (0938-1144) Exp. XX/XX/XXXX

Element 2B: Accurately combine QE Medicare data with claims data from other-payer sources
Self assessment:

Assessment:
The QE accurately combines QE Medicare data with claims data from at least one
other-payer source.

Yes
No

Explanation of Self-assessments:

Evidence Must Include:
1. Description of how provider identifiers were linked across claims data sources. A map may
be used in conjunction with the description.
2. Description of the process implemented to test the accuracy of data linkage and correct
data linkage errors.
3. Error reports demonstrating the volume of data linkage errors.
Note: A screenshot of a previous performance report is not sufficient evidence for this element.
Supporting Documentation:
Document 1
Document Name: ___________________________________________________________
Document Relevance: ________________________________________________________
Relevant Pages: _____________________________________________________________
Document 2
Document Name: ___________________________________________________________
Document Relevance: ________________________________________________________
Relevant Pages: _____________________________________________________________
Document 3
Document Name: ___________________________________________________________
Document Relevance: ________________________________________________________
Relevant Pages: _____________________________________________________________

Department of Health & Human Services
Centers for Medicare & Medicaid Services

C-14
CMS#10394 (0938-1144) Exp. XX/XX/XXXX

STANDARD 3: DATA SECURITY
Intent: The QE must submit documentation that describes its organizational environment. The
organizational environment includes all entities that will be working with the QE or hosting QE
Medicare data. If partnering with other organizations, the QE must provide data flow diagrams
in addition to business and service level agreements. The QE must also provide evidence of an
implemented data security program and privacy policies and procedures, including enforcement
mechanisms for each component of the organization pertaining to its role.
The QE must show the ability to comply with federal data security and privacy requirements to
protect CMS PII data across three broad categories:




Administrative – The QE can demonstrate compliance across select CMS Acceptable Risk
Safegaurds (ARS) administrative control families.
Technical – The QE has documented policies and procedures in place that govern access
to QE Medicare data and data user accounts.
Physical – The QE has documented policies and procedures in place to protect the IT
infrastructure.

Evidence of experience for each of the three categories submitted by the QE may include
demonstrated experience of the lead entity or the entity’s contractor. If the QE is a collaborative,
the evidence must demonstrate the experience of any member organization of the collaborative.
If the QE’s system and protocols do not meet the standards of the ARS or have not yet been fully
implemented for all three categories, the QE may be placed under a security improvement plan
(SIP) to correct the issue, with progress tracked through a plan of action and milestones (POAM)
reporting process.
Opportunity to Leverage Previous Audits: The QECP allows the QE to take advantage of recent
data security assessments or audits. Such audits may be accepted as evidence if they meet the
following criteria:
 The scope of the audit clearly shows coverage of relevant controls
 The assessment was conducted by an independent third party
 The assessment or audit was conducted within the last 365 days
To submit an assessment or audit as evidence, well in advance of a Phase 2 application
submission, the QE should submit the following artifacts:
 The statement of work for the audit or assessment
 The signed audit report page
 The list of artifacts that were submitted and examined during the audit or assessment
 The reviewer’s comments and findings for the assessed controls
The QECP team will then determine the most appropriate and efficient approach for the QE to
complete the QECP Data Security Workbook. For example, the QE could be waived from (a) the

Department of Health & Human Services
Centers for Medicare & Medicaid Services

C-15
CMS#10394 (0938-1144) Exp. XX/XX/XXXX

requirement to enter detailed compliance descriptions within the Data Security Workbook,
and/or (b) the requirement to submit detailed policy and procedure documentation to support
the 18 primary “dash-1” security controls.
Examples of assessments and audits include:






Certification audit against ISO 27001
Assessment and audit against HIPAA standards
SSAE 16 Overview
Statement on Standards for Attestation Engagements (SSAE) No. 16, Reporting on
Controls at a Service Organization
FedRAMP Certification: Must be accompanied by documentation for the services
contracted (e.g., Infrastructure as a Service [IAAS], Platform as a Service [PAAS], or
Software as a Service [SAAS])

QEs with a private FedRAMP certified data center should be able to leverage the FedRAMP
certification documentation for most of the Standard 3 data security controls. However, for QEs
contracting with a FedRAMP-approved cloud service provider (CSP),1 (rather than operating a
FedRAMP certified data center), only a limited number of administrative, technical, and physical
controls can be considered covered by the CSP’s FedRAMP certification. QEs are responsible for
submitting policies and protocols for controls not covered under this FedRAMP certification. To
align with the CMS Information Systems Security and Privacy Policy, 2 QEs are only permitted to
contract with CSPs that are FedRAMP approved.

Element 3A: Administrative Security
Self assessment:

Assessment:
The QE demonstrates its ability to comply with federal data security and privacy
requirements, and documents its processes to follow protocols for the following
CMS ARS elements (control family abbreviations in parentheses):
 Audit and Accountability (AU)
 Security Assessment and Authorization (CA)
 Incident Response (IR)
 Planning (PL)
 Risk Assessment (RA)
 Compliance with applicable state laws regarding privacy and security

Yes
No

The NIST 800-145 definition of a cloud service provider (CSP): http://nvlpubs.nist.gov/nistpubs/Legacy/SP/
nistspecialpublication800-145.pdf.
2
CMS Information Systems Security and Privacy Policy (IS2P2), Version 1.0. [Online] April 26, 2016.
https://www.cms.gov/Research-Statistics-Data-and-Systems/CMS-InformationTechnology/InformationSecurity/Info-Security-Library-Items/CMS-Information-Systems-Security-and-PrivacyPolicy-IS2P2.html.
Department of Health & Human Services
Centers for Medicare & Medicaid Services

C-16
CMS#10394 (0938-1144) Exp. XX/XX/XXXX

Explanation of Self-assessment:

Evidence Must Include:
1. Current assessments showing compliance with the CMS ARS at the moderate impact level
a. If the QE has not undergone any such assessments, it must produce documentation
of the systems and protocols that meet this same threshold with respect to the
security factors listed above
2. Documentation of all breaches of data security or privacy from any component of the QE
organization that occurred within the past 10 years (or the lifetime of the component if
lifetime is less than 10 years)
a. Non-disclosure of previous breaches may impact the QE’s data use approval and delay
the Phase 2 review, requiring further security investigation
b. If undisclosed breaches are discovered after the QE receives QE Medicare data, the QE
may be required to stop using the data and the QE’s certification may be terminated
3. Protocols and systems that will be implemented for transferring information to providers as
part of the requests for corrections and appeals process (Standard 8)
4. A physical network diagram demonstrating the QE organization boundary and how sites
that may access the data are connected, including any Internet, wide area network, local
area network (LAN), and virtual private network (VPN) connections
5. Information flow diagram with a narrative that tracks and describes the management of QE
Medicare data through the system and validates QE organizational roles and responsibilities
(items 6, 7, and 8 below)
6. Concept of operations indicating how the QE intends to secure and limit access to QE
Medicare data
7. List of all parties (contractors and subcontractors) to be included in the CMS Data Use
Agreement (DUA) and their role in the QE program
8. List of all parties (contractors and subcontractors) not to be included in the CMS DUA and
their roles in the QE program
a. In addition to members of the QE, a list of support contractors such as information
technology (IT) hosting providers, Internet service providers, and IT support and
repair contractors

Department of Health & Human Services
Centers for Medicare & Medicaid Services

C-17
CMS#10394 (0938-1144) Exp. XX/XX/XXXX

Supporting Documentation:
Supporting documentation must include a completed QECP Data Security Workbook.
Document 1
Document Name: ___________________________________________________________
Document Relevance: ________________________________________________________
Relevant Pages: _____________________________________________________________
Document 2
Document Name: ___________________________________________________________
Document Relevance: ________________________________________________________
Relevant Pages: _____________________________________________________________
Element 3B: Technical Security
Self assessment:

Assessment:
The QE identifies system users and the prequalification process for access to data
for the following CMS ARS elements (control family abbreviations in parentheses):
 Access Control (AC)
 Awareness and Training (AT)
 Configuration Management (CM)
 Identification and Authentication (IA)
 Personnel Security (PS)

Yes
No

Evidence Must Include:
1. Documentation of the systems and protocols in place with respect to the security factors
described above.
2. Identification of an information security contact person who is responsible for the QE
program and is familiar with the CMS ARS (PM-2).
Supporting Documentation:
Supporting documentation must include a completed QECP Data Security Workbook.
Document 1
Document Name: ___________________________________________________________
Document Relevance: ________________________________________________________
Relevant Pages: _____________________________________________________________
Document 2
Document Name: ___________________________________________________________
Document Relevance: ________________________________________________________
Relevant Pages: _____________________________________________________________

Department of Health & Human Services
Centers for Medicare & Medicaid Services

C-18
CMS#10394 (0938-1144) Exp. XX/XX/XXXX

Element 3C: Physical Security and Privacy
Self assessment:

Assessment:
The QE identifies processes and systems in place to protect its physical IT
infrastructure for the following CMS ARS elements (control family abbreviations
in parentheses):
1. Contingency Planning (CP)
2. Maintenance (MA)
3. Media Protection (MP)
4. Physical and Environmental Protection (PE)
5. System and Communications Protection (SC)
6. System and Services Acquisition (SA)
7. System and Information Integrity (SI)
8. Program Management (PM)
9. Authority and Purpose (AP)
10. Data Quality and Integrity (DI)
11. Security (SE)
12. Accountability, Audit, and Risk Management (AR)
13. Data Minimization and Retention (DM)
14. Transparency (TR)
15. Individual Participation and Redress (IP)
16. Use Limitation (UL)

Yes
No

Evidence Must Include:
1. Documentation of the systems and protocols in place with respect to the security factors
listed above
2. Identification of the physical location of the data processing center (the primary location at
which the CMS data is housed and processing of the measures will occur)
a. If the QE intends to receive CMS data on a hard drive, it must note whether such data
will be stored at this location.
3. Identification of the physical locations at which the CMS data may be accessed, including
any offices or remote users that may have the ability to access identifiable information
4. Identification of the physical locations for any alternate data processing sites, whichare
locations at which data processing will resume in the event of a disaster
5. Identification of the physical location for any alternate storage sites, including the location
for offsite backups and offsite records storage that may house CMS information
a. If the QE intends to receive CMS data on a hard drive and the data will be stored
outside of the primary data processing center, the QE should also note that location.

Department of Health & Human Services
Centers for Medicare & Medicaid Services

C-19
CMS#10394 (0938-1144) Exp. XX/XX/XXXX

Department of Health & Human Services
Centers for Medicare & Medicaid Services

C-20
CMS#10394 (0938-1144) Exp. XX/XX/XXXX

STANDARD 4: MEASURE SELECTION
Intent: The QE must provide documentation for each selected standard or alternative measure
used in public reporting to demonstrate its validity, reliability, responsiveness to consumer
preferences, and applicability.
Note 1: All individual measures, composite measures, and components of composite measures
must be reported under Standard 4. Every composite measure, unless NQF-endorsed as a
composite measure, should be included in 4B as an alternative measure. If any of the component
measures that make up a composite measure are NQF-endorsed, those component measures
should be included in 4A; if the component measures are not NQF-endorsed, they should be
included in 4B.
Note 2: Any QE that intends to report more than 30 measures (inclusive of standard and
alternative measures) using the QE Medicare data must submit the QECP Measure Information
Workbook’s “GT30 List of All Measures” worksheet to their QECP PM well in advance of
submitting Phase 3 evidence. The QECP team will select a sample of measures for which the QE
will be responsible for submitting all evidence outlined in the “Standard Measures” and
“Alternative Measures” worksheets. For those measures not included in the sample, no evidence
or supporting documentation will be required to be reported or uploaded to the application
portal. However, the QE will be required to attest that these non-sampled measures meet the
requirements for all elements under QECP Standards 4 and 5.

Element 4A: Use standard measures
Self assessment:

Assessment:

The QE selects standard measures for incorporating QE Medicare data.

Yes
No

Explanation of Self-assessment:

Department of Health & Human Services
Centers for Medicare & Medicaid Services

C-21
CMS#10394 (0938-1144) Exp. XX/XX/XXXX

Evidence Must Include:
1. Completed 4A items in the QECP Measure Information Workbook (for each standard
measure to be included in QE performance reports), including:
a. NQF-endorsed measure number or CMS measure name or number
b. Name of measure
c. Type of measure (individual, component of composite,3 composite)
d. Name of measure steward/owner
e. Measure description
f. Type of provider to which the measure was applied
g. Rationale for selecting measure
h. Relationship of the measure to existing measurement efforts
i. Relevance of the measure to the population in the covered geographic area defined
under Element 1C
Supporting Documentation:
Document 1
Document Name: ___________________________________________________________
Document Relevance: ________________________________________________________
Relevant Pages: _____________________________________________________________
Document 2
Document Name: ___________________________________________________________
Document Relevance: ________________________________________________________
Relevant Pages: _____________________________________________________________
Document 3
Document Name: ___________________________________________________________
Document Relevance: ________________________________________________________
Relevant Pages: _____________________________________________________________

This is a standard component measure that is included within a composite measure.

Department of Health & Human Services
Centers for Medicare & Medicaid Services

C-22
CMS#10394 (0938-1144) Exp. XX/XX/XXXX

Element 4B: Use approved alternative measures
Self assessments:

Assessments:

1. The QE proposes alternative measures incorporating QE Medicare data.
Composite measures are considered alternative measures, even if they
Yes
combine standard measures, unless the standard measure itself is a
No
composite.
2. The QE demonstrates that the measure is more valid, reliable, responsive
to consumer preferences, cost-effective, or relevant to dimensions of
Yes
quality and resource use not addressed by a standard measure, through
consultation and agreement with stakeholders in the QE’s community or
No
through the notice and comment rulemaking process.
Note: QEs are required to submit evidence for Element 4B only if they select an alternative
measure to evaluate providers.
Explanation of Self-assessment:

Evidence Must Include:
1. Completed 4B items in the QECP Measure Information Workbook for each alternative
measure to be included in QE performance reports:
a. Name of measure
b. Type of measure (individual, component of composite,4 composite)
c. Name of measure steward/owner
d. Measure description
e. Type of provider to which the measure was applied
f. Evidence that the measure is more valid, reliable, responsive to consumer
preferences, cost effective, or relevant to dimensions of quality and resource use
not addressed by a standard measure
g. Relationship of the measure to existing measurement efforts
h. Relevance of the measure to population in the covered geographic area defined
under Element 1C

This is an alternative component measure that is included within a composite measure.

Department of Health & Human Services
Centers for Medicare & Medicaid Services

C-23
CMS#10394 (0938-1144) Exp. XX/XX/XXXX

2. Process to monitor and evaluate if new scientific evidence is released or a related standard
measure is endorsed, including planned frequency of research, names and titles of staff
responsible for research, and the sources to be referenced when researching whether
alternative measures become standard.
3. Documentation of consultation and agreement with stakeholders in the QE’s community,
with a description of the discussion about the proposed alternative measure, including a
summary of all pertinent arguments supporting and opposing the measure or
documentation of notice and comment rulemaking process approval.
4. Approval or sign-off of relevant alternative measure meeting minutes from committee or
committee chairs.
Supporting Documentation:
Document 1
Document Name: ___________________________________________________________
Document Relevance: ________________________________________________________
Relevant Pages: _____________________________________________________________
Document 2
Document Name: ___________________________________________________________
Document Relevance: ________________________________________________________
Relevant Pages: _____________________________________________________________
Document 3
Document Name: ___________________________________________________________
Document Relevance: ________________________________________________________
Relevant Pages: _____________________________________________________________

Department of Health & Human Services
Centers for Medicare & Medicaid Services

C-24
CMS#10394 (0938-1144) Exp. XX/XX/XXXX

STANDARD 5: METHODOLOGY FOR MEASUREMENT AND ATTRIBUTION OF
PATIENT SERVICES AND EPISODES
Intent: The QE must provide evidence of its ability to accurately calculate quality, efficiency, or
resource use measures from claims data for measures it intends to calculate with QE Medicare
data.
Element 5A: Follow measure specifications
Self assessment:

Assessment:
The QE uses measure specifications accurately for selected measures, including
numerator and denominator inclusions and exclusions, measured time periods,
and specified data sources.

Yes
No

Explanation of Self-assessment:

Evidence Must Include:
1. Completed 5A items in the QECP Measure Information Workbook. For each measure listed
in 4A and 4B, include:
a. Hyperlink, URL, or copy of the measure specification from measure steward
b. Hyperlink, URL, or copy of the measure specification for implementation (if different
from measure steward’s specification)
c. Clinical logic (e.g., denominator eligibility, numerator eligibility, exclusion criteria)
d. Construction logic (e.g., trigger start dates, temporal parameters)
e. System input/output reports/logs for each measure displaying data sources,
exclusion statements, denominator values, and numerator values

Department of Health & Human Services
Centers for Medicare & Medicaid Services

C-25
CMS#10394 (0938-1144) Exp. XX/XX/XXXX

Supporting Documentation:
Document 1
Document Name: ___________________________________________________________
Document Relevance: ________________________________________________________
Relevant Pages: _____________________________________________________________
Document 2
Document Name: ___________________________________________________________
Document Relevance: ________________________________________________________
Relevant Pages: _____________________________________________________________
Document 3
Document Name: ___________________________________________________________
Document Relevance: ________________________________________________________
Relevant Pages: _____________________________________________________________

Department of Health & Human Services
Centers for Medicare & Medicaid Services

C-26
CMS#10394 (0938-1144) Exp. XX/XX/XXXX

Element 5B: Use a defined and transparent method for attribution of patient services and
episodes
Self Assessment:
assessments:
The QE applies an appropriate method to attribute a particular patient’s
services or episodes to specific providers.

Yes
No

Explanation of Self-assessment:

Evidence Must Include:
Completed 5B items within the QECP Measure Information Workbook, including a description of
the methodology used to assign patients and/or episodes to the provider included in the
performance reports.
Note: If methods for attribution of patient services or episodes vary across the measures listed in
Elements 4A and 4B, this should be noted and described accordingly.
Supporting Documentation:
Supporting documentation must include a completed QECP Measure Information Workbook.
Document 1
Document Name: ___________________________________________________________
Document Relevance: ________________________________________________________
Relevant Pages: _____________________________________________________________
Document 2
Document Name: ___________________________________________________________
Document Relevance: ________________________________________________________
Relevant Pages: _____________________________________________________________
Document 3
Document Name: ___________________________________________________________
Document Relevance: ________________________________________________________
Relevant Pages: _____________________________________________________________

Department of Health & Human Services
Centers for Medicare & Medicaid Services

C-27
CMS#10394 (0938-1144) Exp. XX/XX/XXXX

Element 5C: Set and follow requirements to establish statistical validity of measure results for
quality measures
Self Assessment:
assessment:
For reporting quality measures using QE Medicare data, the QE uses only
measures with at least 30 observations, or the calculated confidence interval is
Yes
at least 90%, or the measure reliability is at least 0.70.
Note: The QE is required to submit evidence for Element 5C only if it selects quality
measures to evaluate providers.

No
N/A

Explanation of Self-assessment:

Evidence Must Include:
1. Completed 5C items in the QECP Measure Information Workbook. For each measure listed
in 4A and 4B, the QE must include:
a. Description of the minimum requirements for reporting each quality measure that
incorporates QE Medicare data, including one of the following: minimum sample
size (or denominator size) requirements, minimum calculated confidence interval, or
minimum reliability score requirements.
b. Results of statistical validity testing for each quality measure to be included in QE
performance reports, including the actual sample/denominator size, confidence
interval, or reliability score.

Department of Health & Human Services
Centers for Medicare & Medicaid Services

C-28
CMS#10394 (0938-1144) Exp. XX/XX/XXXX

Department of Health & Human Services
Centers for Medicare & Medicaid Services

C-29
CMS#10394 (0938-1144) Exp. XX/XX/XXXX

Element 5D: Set and follow requirements to establish statistical validity of measure results
for efficiency and resource use measures
Self Assessments:
assessments:
Yes
1. For selected efficiency and resource use measures using QE Medicare
data, the QE only uses measures for which reliability and validity are
No
demonstrated.
N/A
2. For selected efficiency and resource use measures using QE Medicare
data that use a standardized payment or pricing approach, provide the
specified standardized payment methodology actually being used.

Yes
No
N/A

Note: QEs are required to submit evidence for Element 5D only if they select efficiency or resource
use measures to evaluate providers.
Explanation of Self-assessments:

Evidence Must Include:
1. Completed 5D items in the QECP Measure Information Workbook. For each measure listed
in 4A and 4B, the QE must include:
a. Description of the minimum requirements for reporting each efficiency and resource
use measure that incorporates QE Medicare data, including the minimum calculated
confidence interval or reliability score
b. Results of statistical validity testing for each efficiency and resource use measure to
be included in QE performance reports, including the actual sample/denominator
size and at least one of the following: reliability score or confidence interval
c. Description of the standardized payment or pricing approach, if appropriate

Department of Health & Human Services
Centers for Medicare & Medicaid Services

C-30
CMS#10394 (0938-1144) Exp. XX/XX/XXXX

Department of Health & Human Services
Centers for Medicare & Medicaid Services

C-31
CMS#10394 (0938-1144) Exp. XX/XX/XXXX

Element 5E: Set and follow requirements to establish validity of measure results for
composite measures
Self Assessment:
assessment:
Yes
For reporting composite measures using QE Medicare data, the QE describes the
No
measures that make up each composite.
N/A
Note: The QE is required to submit evidence for Element 5E only if it selects composite measures
to evaluate providers. Evidence for Elements 5A-D and 5F-G must be provided for each component
measure included in composite measures.
Explanation of Self-assessment:

Evidence Must Include:
1. Completed 5E items in the QECP Measure Information Workbook, including:
a. Construction of the composite
i. List of measures
ii. Weight of each measure
1. Note: If measures are weighted differently, rationale must be
provided.
iii. Calculation of composite (e.g., take average of all rates and divide by number
of measures or all-or-none scoring)
b. Description of the minimum requirements for including or excluding a measure
within the composite measure

Department of Health & Human Services
Centers for Medicare & Medicaid Services

C-32
CMS#10394 (0938-1144) Exp. XX/XX/XXXX

Department of Health & Human Services
Centers for Medicare & Medicaid Services

C-33
CMS#10394 (0938-1144) Exp. XX/XX/XXXX

Element 5F: Use appropriate methods to employ risk adjustment
Self assessment:

Assessment:
The QE provides a rationale for using or not using a risk adjustment method for
each selected measure. Furthermore, the QE provides a description of the risk
adjustment method for each applicable measure.
Note: The QE is required to submit evidence for Element 5F only if it selects a
measure that specifies a risk adjustment method.

Yes
No
N/A

Explanation of Self-assessment:

Evidence Must Include:
1. Completed 5F items in the QECP Measure Information Workbook. For each measure listed
in 4A and 4B, the QE must include:
a. The rationale for using or not using risk adjustment
i. If risk adjustment was not used, the QE must include a detailed justification
b. The methodology used for risk adjustment (including case-mix or severity
adjustment) wherever risk adjustment was applied
Supporting Documentation:
Document 1
Document Name: ___________________________________________________________
Document Relevance: ________________________________________________________
Relevant Pages: _____________________________________________________________
Document 2
Document Name: ___________________________________________________________
Document Relevance: ________________________________________________________
Relevant Pages: _____________________________________________________________
Document 3
Document Name: ___________________________________________________________
Document Relevance: ________________________________________________________
Relevant Pages: _____________________________________________________________
Department of Health & Human Services
Centers for Medicare & Medicaid Services

C-34
CMS#10394 (0938-1144) Exp. XX/XX/XXXX

Element 5G: Use appropriate methods to handle outliers
Self assessment:

Assessment:
The QE describes its outlier method (i.e., how to identify and account for
outliers) for each selected measure as applicable.

Yes
No

Explanation of Self-assessment:

Evidence Must Include:
1. Completed 5G items in the QECP Measure Information Workbook. For each measure listed
in 4A and 4B, the QE must include:
a. The rationale for using or not using an outlier method
i. If an outlier method was not used, the QE must include a detailed justification
b. Where an outlier method was used, a detailed description of the outlier method,
specifically how outliers were identified (e.g., more than three standard deviations
from the mean) and how outliers were accounted for (e.g., truncation or removal of
outlier)
Supporting Documentation:
Document 1
Document Name: ___________________________________________________________
Document Relevance: ________________________________________________________
Relevant Pages: _____________________________________________________________
Document 2
Document Name: ___________________________________________________________
Document Relevance: ________________________________________________________
Relevant Pages: _____________________________________________________________
Document 3
Document Name: ___________________________________________________________
Document Relevance: ________________________________________________________
Relevant Pages: _____________________________________________________________

Department of Health & Human Services
Centers for Medicare & Medicaid Services

C-35
CMS#10394 (0938-1144) Exp. XX/XX/XXXX

Element 5H: Use comparison groups when comparing evaluated providers
Self assessment:

Assessment:
The QE defines the comparison groups it uses to report results for each selected
measure.
Note: The QE is required to submit evidence for Element 5H only if it plans to use
comparison groups to evaluate providers.

Yes
No

Explanation of Self-assessment:

Evidence Must Include:
1. Completed 5H items in the QECP Measure Information Workbook. For each measure to be
included in QE performance reports, the QE must include:
a. A description of the algorithm used to identify comparison groups (e.g., groups are
compared by clinic for clinics with three or more practicing physicians)
b. The geographic parameters that were used to compare providers to their peers.
(e.g., North region includes counties A, B, and C)
Supporting Documentation:
Document 1
Document Name: ___________________________________________________________
Document Relevance: ________________________________________________________
Relevant Pages: _____________________________________________________________
Document 2
Document Name: ___________________________________________________________
Document Relevance: ________________________________________________________
Relevant Pages: _____________________________________________________________
Document 3
Document Name: ___________________________________________________________
Document Relevance: ________________________________________________________
Relevant Pages: _____________________________________________________________

Department of Health & Human Services
Centers for Medicare & Medicaid Services

C-36
CMS#10394 (0938-1144) Exp. XX/XX/XXXX

Element 5I: Use benchmarks when evaluating providers
Self assessment:

Assessment:
The QE defines the benchmarks it uses to report results for each selected
measure.
Note: The QE is required to submit evidence for Element 5I only if it plans to use
benchmarks to evaluate providers.

Yes
No

Explanation of Self-assessment:

Evidence Must Include:
1. Completed 5I items in the QECP Measure Information Workbook. For each measure to be
included in QE performance reports, the QE must include:
a. How the benchmark was identified or estimated (e.g., benchmark from federal,
state, or community report, calculated by averaging all the physician rates included
in performance report)
b. Type of benchmark used (e.g., national or regional 90th percentile, national or
regional average)
Supporting Documentation:
Document 1
Document Name: ___________________________________________________________
Document Relevance: ________________________________________________________
Relevant Pages: _____________________________________________________________
Document 2
Document Name: ___________________________________________________________
Document Relevance: ________________________________________________________
Relevant Pages: _____________________________________________________________
Document 3
Document Name: ___________________________________________________________
Document Relevance: ________________________________________________________
Relevant Pages: _____________________________________________________________

Department of Health & Human Services
Centers for Medicare & Medicaid Services

C-37
CMS#10394 (0938-1144) Exp. XX/XX/XXXX

Element 5J: Use valid rating approach(es)
Self assessment:

Assessment:
The QE uses valid methods for determining and calculating provider ratings, if
measure calculations are aggregated or used to calculate provider ratings (e.g.,
stars, or good/better/best).
Note: The QE is required to submit evidence for Element 5J only if it plans to report
provider ratings.

Yes
No

Explanation of Self-assessment:

Evidence Must Include:
Completed 5J items in the QECP Measure Information Workbook. For each measure to be
included in QE performance reports, the QE must include a detailed description of the rating
approach(es), including rating calculation and statistical methods used.
Note: A screenshot from the public report that shows this information is not sufficient evidence
for this item.
Supporting Documentation:
Document 1
Document Name: ___________________________________________________________
Document Relevance: ________________________________________________________
Relevant Pages: _____________________________________________________________
Document 2
Document Name: ___________________________________________________________
Document Relevance: ________________________________________________________
Relevant Pages: _____________________________________________________________
Document 3
Document Name: ___________________________________________________________
Document Relevance: ________________________________________________________
Relevant Pages: _____________________________________________________________

Department of Health & Human Services
Centers for Medicare & Medicaid Services

C-38
CMS#10394 (0938-1144) Exp. XX/XX/XXXX

STANDARD 6: VERIFICATION PROCESS
Intent: The QE must provide evidence of an ongoing process to correct measurement errors and
assess measure reliability.
Element 6A: Systematically evaluate accuracy of the measurement process and correct errors
Self assessment:

Assessment:
The QE describes quality assurance procedures for its measurement and
reporting processes, including the correction of errors and updating of
performance reports.

Yes
No

Explanation of Self-assessment:

Evidence Must Include:
1. Completed QECP Measure Production Quality Assurance (QA) Worksheet, including:
a. Department/vendor responsibilities
i. Name, credentials, and title of staff responsible for verifying the
measurement process
b. Data files and data accuracy
i. Internal verification, audit process, or software used to evaluate the accuracy
of calculating performance measures from claims data
c. QA process
i. Process for correcting errors in measurement and reporting processes
ii. Process for updating reports to providers and consumers
2. QA Reports:
a. Sample reports generated by the QA process

Department of Health & Human Services
Centers for Medicare & Medicaid Services

C-39
CMS#10394 (0938-1144) Exp. XX/XX/XXXX

Supporting Documentation:
Supporting documentation must include a completed QECP Measure Production Quality
Assurance (QA) Worksheet.
Document 1
Document Name: ___________________________________________________________
Document Relevance: ________________________________________________________
Relevant Pages: _____________________________________________________________
Document 2
Document Name: ___________________________________________________________
Document Relevance: ________________________________________________________
Relevant Pages: _____________________________________________________________
Document 3
Document Name: ___________________________________________________________
Document Relevance: ________________________________________________________
Relevant Pages: _____________________________________________________________

Department of Health & Human Services
Centers for Medicare & Medicaid Services

C-40
CMS#10394 (0938-1144) Exp. XX/XX/XXXX

STANDARD 7: REPORTING OF PERFORMANCE INFORMATION
Intent: The QE must demonstrate expertise in the design and dissemination of performance
reports, as well as the capacity and commitment to continuously improve the reporting process.
Element 7A: Design reporting for providers and the public
Self assessments:

Assessments:
1. The QE designs public and provider reports using QE Medicare data, that
display the following components:
a. Measure results clearly indicating the level of reporting, rating
approaches (e.g., number of stars), peer group comparisons, and
benchmarks
b. Understandable descriptions of measures and key measure
methodologies as appropriate for the provider and public audiences
2. The QE plans dissemination of information to providers and the public at least

Yes
No

Yes

annually.

No
Note: The QE must report measures uniformly across the provider and public reports, including
identical level of analysis, rates, ratings, peer group comparisons, and benchmarks.
Explanation of Self-assessment:

Evidence Must Include:
1. Screenshots of the confidential provider performance report and public performance report
a. If the provider and public performance reports have not been developed, prototypes
are acceptable; however, once the reports have been developed, screenshots must be
uploaded as evidence. The confidential provider performance report and the public
performance report must include the following items (with evidence provided for each
item):
i. Performance results and ratings
ii. Results of comparison group and benchmark analysis (if applicable)

Department of Health & Human Services
Centers for Medicare & Medicaid Services

C-41
CMS#10394 (0938-1144) Exp. XX/XX/XXXX

iii. Level of reporting (i.e. Individual Clinician, Clinic, Group/Practice, Team,
Facility, Health Plan-Defined Group of Physicians, or Integrated Delivery
System)
iv. Reporting at the appropriate level that is consistent with measure
specifications
v. List of types of providers in each geographic area to be reported in the QE
performance report (e.g., three physicians per site and PCPs only)
vi. Indication of whether or not each measure includes QE Medicare data
vii. An understandable description of the measures used to evaluate the
performance of providers so that consumers, providers, health plans,
researchers, and other stakeholders can assess performance reports
viii. An understandable description of any provider rating approaches (e.g., stars or
good/better/best)
ix. Indication of performance measures in dispute including the name of the
appealing provider and category of the appeal or request
2. Provider and public report dissemination plans, including:
a. Information on how to locate reports
b. Date of release and frequency of subsequent releases
c. Method of distribution
d. Target audiences
e. Source of contact information for providers reviewing confidential provider
performance reports
Supporting Documentation:
Document 1
Document Name: ___________________________________________________________
Document Relevance: ________________________________________________________
Relevant Pages: _____________________________________________________________
Document 2
Document Name: ___________________________________________________________
Document Relevance: ________________________________________________________
Relevant Pages: _____________________________________________________________
Document 3
Document Name: ___________________________________________________________
Document Relevance: ________________________________________________________
Relevant Pages: _____________________________________________________________

Department of Health & Human Services
Centers for Medicare & Medicaid Services

C-42
CMS#10394 (0938-1144) Exp. XX/XX/XXXX

Element 7B: Improve reporting
Self assessment:
Yes
The QE has a process to continuously improve public reporting on health care
quality, efficiency, or resource use.
No
Explanation of Self-assessment:
Assessment:

Evidence Must Include:
Must include:
1. Description of how report designers collect user feedback
2. Definition of “user”
3. Action plans or next steps resulting from user feedback, including whether the plan or
step has been implemented
4. Description of the QE’s continuous and ongoing reporting improvement process
Supporting Documentation:
Document 1
Document Name: ___________________________________________________________
Document Relevance: ________________________________________________________
Relevant Pages: _____________________________________________________________
Document 2
Document Name: ___________________________________________________________
Document Relevance: ________________________________________________________
Relevant Pages: _____________________________________________________________
Document 3
Document Name: ___________________________________________________________
Document Relevance: ________________________________________________________
Relevant Pages: _____________________________________________________________

Department of Health & Human Services
Centers for Medicare & Medicaid Services

C-43
CMS#10394 (0938-1144) Exp. XX/XX/XXXX

STANDARD 8: REQUESTS FOR CORRECTIONS OR APPEALS
Intent: The QE must provide evidence of implementing and maintaining an acceptable process
for providers identified in a report to review the report at least 60 calendar days prior to
publication, and for delivering a timely response to provider inquiries regarding requests for data,
error correction, and appeals.
Element 8A: Use corrections process
Self assessment:

Assessment:
The QE has established a process to allow providers to view reports
confidentially at least 60 calendar days prior to publication, request data, and
ask for correction of errors.

Yes
No

Explanation of Self-assessment:

Evidence Must Include:
1. Description of how provider performance reports (without beneficiary protected health
information) will be transmitted to providers
2. The timeline to be followed to complete the corrections process prior to releasing reports
to the public
i.
The data must be shared with the provider at least 60 calendar days prior to publicly
reporting results.
3. Description of how providers can request corrections prior to public reporting
Supporting Documentation:
Document 1
Document Name: ___________________________________________________________
Document Relevance: ________________________________________________________
Relevant Pages: _____________________________________________________________
Document 2
Document Name: ___________________________________________________________
Document Relevance: ________________________________________________________
Relevant Pages: _____________________________________________________________
Department of Health & Human Services
Centers for Medicare & Medicaid Services

C-44
CMS#10394 (0938-1144) Exp. XX/XX/XXXX

Element 8B: Use secure transmission of beneficiary data
Self assessment:

Assessment:
The QE has established a process that applies privacy and security protections to
the release of beneficiary identifiers and/or claims data to providers for the
purposes of the requests for corrections/appeals process.
Explanation of Self-assessment:

Yes
No

Evidence Must Include:
1. Artifacts that explain the processes and procedures associated with the control families
relevant to Element 8B, including a description of the process ensuring that only the
minimum necessary beneficiary identifiers and/or claims data will be disclosed in the event
of a request by a provider, as well as the method for secure transmission and the entity
responsible for secure transmission
a. When describing the method for secure data transmission, QEs must include
information about how organizations will ensure adherence to the following ARS
security control families approved during Phase 2 of the QE’s data security review
for Elements 3B and 3C:
i. Element 3B – Security Control Family: Access Control
ii. Element 3B – Security Control Family: Identification and Authentication
iii. Element 3C – Security Control Family: Media Protection
iv. Element 3C – Security Control Family: Program Management
v. Element 3C – Security Control Family: Personnel Security
vi. Element 3C – Security Control Family: System and Communications
Protection
vii. Element 3C – Security Control Family: System and Information Integrity
viii. Element 3C – Security Control Family: Accountability, Audit, and Risk
Management
ix. Element 3C – Security Control Family: Data Minimization and Retention
x. Element 3C – Security Control Family: Security
xi. Element 3C – Security Control Family: Use Limitation
2. Annotated data flow diagram with narratives that explain the following:
a. How the QE will verify that only the appropriate representatives within a provider group
are permitted to access personally identifiable information (PII) in the event of a request
for correction
Department of Health & Human Services
Centers for Medicare & Medicaid Services

C-45
CMS#10394 (0938-1144) Exp. XX/XX/XXXX

b. How access credentials to PII are communicated to the appropriate representatives
within each provider group and authorized representatives may create additional access
accounts (and communicate credentials) to additional authorized individuals within their
provider group
c. How only the minimum necessary beneficiary identifiers and claims data will be disclosed
to providers who request data
d. Mechanism used to transmit beneficiaries’ PII to providers in the event of a request for
correction
e. Name of organization/contractor responsible for transmitting beneficiaries’ PII to
providers in the event of a request for correction
Supporting Documentation:
Document 1
Document Name: ___________________________________________________________
Document Relevance: ________________________________________________________
Relevant Pages: _____________________________________________________________
Document 2
Document Name: ___________________________________________________________
Document Relevance: ________________________________________________________
Relevant Pages: _____________________________________________________________
Document 3
Document Name: ___________________________________________________________
Document Relevance: ________________________________________________________
Relevant Pages: _____________________________________________________________

Department of Health & Human Services
Centers for Medicare & Medicaid Services

C-46
CMS#10394 (0938-1144) Exp. XX/XX/XXXX

Section 5: Attestation
Instructions: Prior to an application being submitted as final, the contents of the application must
be accompanied with a completed attestation from an individual at the entity authorized to
attest to its accuracy and completion.
To the best of my knowledge and belief, all data in this application are true and correct, the
document has been duly authorized by the governing body of the applicant, and the applicant
will comply with the terms and conditions of the award and applicable Federal requirements
awarded.
Authorized Representative’s Name (printed) _________________________________________
Authorized Representative’s Title (printed) __________________________________________
Signature_____________________________________________ Date ____________________
Phone _______________________________________ Fax _____________________________

Department of Health & Human Services
Centers for Medicare & Medicaid Services

C-47
CMS#10394 (0938-1144) Exp. XX/XX/XXXX

Section 6: Additional Supporting Documentation
Instructions: Please describe all additional supporting documentation submitted in conjunction
with this application that is not listed in Section 4.
1.

Standard: _____________
Element: _____________
Document Name: _______________________________________________________
Document Relevance: ____________________________________________________
Relevant Pages: _________________________________________________________

Department of Health & Human Services
Centers for Medicare & Medicaid Services

C-48
CMS#10394 (0938-1144) Exp. XX/XX/XXXX

10.

11.

12.

13.

Department of Health & Human Services
Centers for Medicare & Medicaid Services

C-49
CMS#10394 (0938-1144) Exp. XX/XX/XXXX

File Type	application/pdf
File Title	Appendix C: Paper Based QE Application Form
Subject	Appendix C: Paper Based QE Application Form
Author	Department of Health and Human Services
File Modified	2018-03-26
File Created	2018-03-21