Application and Re-application processes

Revised 11/22/17

[MONTH DD, YYYY]
[CONTACT]
[ENTITY]
[ADDRESS]
[CITY, STATE] [ZIP]
VIA EMAIL: [E-MAIL ADDRESS]
Director
Offices of Enterprise Management
Centers for Medicare & Medicaid Services
200 Independence Ave., S.W
Mail stop: 337D
Washington, DC 20001
Dear Director:
This letter outlines the understanding between the Centers for Medicaid & Medicare Services (CMS) and
[ENTITY] with regard to [ENTITY]’s intent to complete the Qualified Entity Certification Review for the
remaining minimum requirements:

Ensuring data security (QECP Standard 3)

Combining data sources (QECP Standard 2B)

Measure selection (QECP Standard 4)

Measurement methodology (QECP Standard 5)

Verification process (QECP Standard 6)

Reporting (QECP Standard 7)

Provider corrections and appeals (QECP Standard 8)
Once CMS determines that Standard 3 is sufficiently met, we will request and obtain a QE Data Use
Agreement (DUA) and the Medicare Parts A and B claims data or Part D prescription drug event (PDE)
data we intend to use for the performance reports.
Further, [ENTITY] agrees to complete the remaining minimum requirements listed in this document and,
if CMS deems sufficient, publicly release a QE provider performance report within 12 months of receipt
of the QE Medicare data received under the QE DUA (as proposed in Attachment A).
We acknowledge that CMS has determined that we have sufficiently:
1. Completed and attached evidence in the QECP Portal for Standards 1 (all Elements) and
Standard 2 (Element 2A only).
2. Attested to the ability to meet all standards by marking “MET” or “UNMET” in the QECP secure
application portal for each Element’s self-assessment.
3. Signed and submitted our Letter of Commitment, which includes:

Proposed timeline for completing remaining Standard requirements and public
reporting—Attachment A

Contractual Relationship Attestation—Attachment B (if applicable)

QIO Attestation—Attachment C (if applicable)
Page 1
CMS#10394 (0938-1144) Exp. XX/XX/XXXX

QE Medicare data will be distributed to [ENTITY] upon successful completion of Standard 3 (Phase 2:
Data Security), CMS approval of submitted QE DUA materials, and payment of appropriate fees for the
QE Medicare data. Compliant and Partially Compliant Phase 2 review outcomes do not provide a CMS
endorsement nor do they validate the sufficiency of the QE’s data security and privacy program for
purposes outside of the QECP. QECP Phase 2 review outcomes are based solely on the information QEs
provide to CMS at the time of the Phase 2 review. There is no expressed guarantee regarding the future
performance of a QE, especially as new system, personnel, and environmental vulnerabilities and
threats are continually evolving.
[ENTITY] may not distribute provider or public reports containing QE Medicare claims data provided
under this program until the QECP team has reviewed [ENTITY]’s compliance with all of the program
requirements. Upon review, if [ENTITY] does not demonstrate compliance with QECP requirements,
CMS reserves the right to retract QE Certification and require [ENTITY] to destroy or return QE Medicare
data.
Included as part of this letter are:

Attachment A: Proposed Timeline for QECP Compliance and Public Reporting;

Attachment B: Contractual Relationship Attestation (if applicable); and

Attachment C: QIO Attestation (if applicable).
If the terms of this understanding are acceptable to [ENTITY], please acknowledge your agreement
below and upload an executed copy of this letter to the entity’s secure application portal.
ACCEPTED:

Name of Entity

Address of Entity

Telephone Number

Signature of Authorized Officer

Date

Name and Title of Authorized Officer
PRA Disclosure Statement: According to the Paperwork Reduction Act of 1995, no persons are required to respond to a
collection of information unless it displays a valid OMB control number. The valid OMB control number for this information
collection is 0938-1144. The time required to complete this information collection is estimated to average 500 hours per
response, including the time to review instructions, search existing data resources, gather the data needed, and complete and
review the information collection. If you have comments concerning the accuracy of the time estimate(s) or suggestions for
improving this form, please write to: CMS, 7500 Security Boulevard, Attn: PRA Reports Clearance Officer, Mail Stop C4-26-05,
Baltimore, Maryland 21244-1850.

Page 2
CMS#10394 (0938-1144) Exp. XX/XX/XXXX

Attachment A: [ENTITY]’s
Proposed Timeline for QECP Compliance and Public Reporting
Milestone

Phase 2 Evidence Approved*

Standard 3
QE DUA (and Optional Research DUA) Completed
Data Payment Made
QE Medicare Data Received
Milestone
Phase 3 Evidence Approved*

Standard 2B

Standard 4

Standard 5

Standard 6

Standard 7

Standard 8
Initiation of Provider Corrections and Appeals Process
(Required 60 days before public report)
First Public Report Released

Weeks from Phase 1
Certification
(example)

Weeks from Phase 1
Certification
(to be completed by
entity)

24
32
34
38-40
Weeks from Receipt
of QE Medicare Data
(example)

Weeks from Receipt
of QE Medicare Data
(to be completed by
entity)

0–38

42
52

*Note: The time frame allotted for Phase 2 and Phase 3 evidence approval includes the time the QE requires to
assemble and submit required evidence AND the time the QECP team requires to review the submitted
evidence.

Page A-1
CMS#10394 (0938-1144) Exp. XX/XX/XXXX

Attachment B: [ENTITY]’s
Contractual Relationship Attestation
CONTRACTUAL RELATIONSHIP ATTESTATION

Lead and Contractor or Member Organizations
Legal Name of Lead Entity
Trade Name/DBA
Name(s) of Contractor or Member
Organizations
(if applicable)
Does any organization on your
team (Lead or Other) also hold a
QIO contract with CMS?

 Yes
List Organization(s):

(If yes, complete Attachment C –
QIO Attestation)

 No

Repeat the following two tables for each Contractor or Member Organization relevant to the entity’s
Qualified Entity application and program.

Attestation of Agreement with Contractor or Member Organization
Legal Name of Contractor or Member
Organization
Trade Name/DBA
Description of Contractual Relationship
General description of agreements in place
between the lead entity and other contractor
or member organizations (as applicable).

Effective dates on agreement
The partner noted above will be responsible
for or involved in meeting compliance for the
following QECP Standards:
Page B-1
CMS#10394 (0938-1144) Exp. XX/XX/XXXX

Attachment B: [ENTITY]’s
Contractual Relationship Attestation

Affirmation Statements
The lead entity must attest to the following statements with regard to each Contractor or Member
Organization (as applicable) by answering each statement.
STATEMENT

YES

NO

Contractor or Member Organization is willing to sign a Qualified Entity
Certification Program (QECP) Data Use Agreement (DUA).
Contractor or Member Organization understands that it will also be
subject to CMS review as part of the QECP and its actions may result in
sanctions and/or termination of the Qualified Entity.
Lead and Contractor or Member Organization have a legally
enforceable agreement in place that includes breach-of-contract
liability if one of the members of the group fails to deliver and there
would be the potential of collecting damages for that failure to
perform.
Signature
To the best of my knowledge and belief, all data in this attestation are true and correct, the document has
been authorized by the governing body of the lead entity, and the lead entity will comply with the terms
and conditions of the award and applicable Federal requirements.
Authorized Representative Name (printed) ___________________________________________
Authorized Representative Title (printed) ____________________________________________

Signature_____________________________________________ Date ____________________
Phone______________________________________

Page B-2
CMS#10394 (0938-1144) Exp. XX/XX/XXXX

Attachment C: Quality Improvement Organization (QIO) Attestation
CMS QUALITY IMPROVEMENT ORGANIZATION ATTESTATION
An entity that holds a QIO contract with CMS is permitted to function as a QE, or as part of a QE team,
under the following conditions:
 The entity may not represent the fact that they are a QIO while conducting QE activities;
 Any resources, both financial and operational, funded by CMS as part of the QIO contract may
not be used to sustain the entity’s QE program in any way;
 The entity must continue to uphold all terms of their QIO contract, including their confidentiality
and conflict of interest contractual obligations. The entity may wish to request a conflict of
interest determination by the CMS Office of Acquisitions and Grants Management; and
 The entity must complete an attestation during Phase 1 of the QECP Minimum Requirements
Review attesting that they will adhere to the three conditions listed above.
The table and signature section below must be completed by an authorized representative for each
entity in your QE team that holds a QIO contract with CMS. If none, you are not required to submit
Attachment C.
QIO Demographics
Name of Entity Recognized as a QIO (lead entity
or partner/collaborator as part of the QE team)
State(s) for which Entity Functions as a QIO

QIO Contact within the Entity
(name, title, email address, phone number)
QIO Contact within CMS
(name, title, email address, phone number)
QIO Affirmation Statements
We agree to maintain distinct and separate representation between QE and
QIO activities. We will not represent QE work or resulting products to be a
function of our QIO contract with CMS.
We agree to maintain funding for QE activities separate from QIO funded CMS
sources. Funds or resources provided by CMS to support the QIO program will
not be used or spent for the QE program, including funds or resources for
operating the QIO Standard Data Processing Systems (SDPS). QE-obtained
Medicare data will not be stored on the SDPS.
If approved as a Certified QE (or a member of a Certified QE team), we agree to
uphold all terms of our QIO contract, including confidentiality and conflict of
interest contractual obligations. We understand that, per our request, a QE/QIO
conflict of interest analysis can be performed by CMS-OAGM.

 Yes
 No

 Yes
 No

 Yes
 No

Page C-1
CMS#10394 (0938-1144) Exp. XX/XX/XXXX

Attachment C: Quality Improvement Organization (QIO) Attestation
Signature
To the best of my knowledge and belief, all information in this attestation is true and correct; the
document has been authorized by the governing body of the entity mentioned on page C-1; and the entity
will comply with all terms and conditions of the affirmation statements mentioned on pages C-1 through
C-2.
(Authorized Representative for QIO and QE Entity)
Name (printed) ___________________________________________
Title (printed) ____________________________________________
Email Address (printed) ___________________________________

Signature_____________________________________________ Date ____________________
Phone______________________________________

Page C-2
CMS#10394 (0938-1144) Exp. XX/XX/XXXX