Title 42

SECTION 414.1400

414.1400 Third party intermediaries.

§ 414.1400 Third party intermediaries.

(a) General. (1) MIPS data may be submitted on behalf of a MIPS eligible clinician, group, or virtual group by any of the following third party intermediaries:

(i) A QCDR;

(ii) A qualified registry;

(iii) A health IT vendor; or

(iv) A CMS-approved survey vendor.

(2) Beginning with the 2023 MIPS payment year, QCDRs and qualified registries must be able to submit data for all of the following MIPS performance categories, and Health IT vendors must be able to submit data for at least one of the following MIPS performance categories:

(i) Except as provided under paragraph (a)(2)(ii) of this section, QCDRs, qualified registries, and Health IT vendors must be able to submit data for all of the following MIPS performance categories:

(A) Quality, except:

(1) The CAHPS for MIPS survey; and

(2) For qualified registries and Health IT vendors, QCDR measures;

(B) Improvement activities; and

(C) Promoting Interoperability, if the eligible clinician, group, or virtual group is using CEHRT; however, a third party intermediary may be excepted from this requirement if its MIPS eligible clinicians, groups or virtual groups fall under the reweighting policies at § 414.1380(c)(2)(i)(A)(4) or (5) or (c)(2)(i)(C)(1) through (7) or (c)(2)(i)(C)(9).

(ii) Health IT vendors that do not support MIPS Value Pathways must be able to submit data for at least one of the MIPS performance categories described in paragraphs (a)(2)(i)(A) through (C) of this section.

(iii) Promoting Interoperability, if the eligible clinician, group, or virtual group is using CEHRT; however, a third party intermediary may be excepted from this requirement if its MIPS eligible clinicians, groups or virtual groups fall under the reweighting policies at § 414.1380(c)(2)(i)(A)(4) or (5) or § 414.1380(c)(2)(i)(C)(1) through (7) or § 414.1380(c)(2)(i)(C)(9)).

(3) CMS-approved survey vendors may submit data on the CAHPS for MIPS survey for the MIPS quality performance category.

(4) Third party intermediary approval criteria -

(i) To be approved as a third party intermediary, an entity must agree to meet the applicable requirements of this section, including, but not limited to, the following:

(A) A third party intermediary's principle place of business and retention of any data must be based in the U.S.

(B) If the data is derived from CEHRT, a QCDR, qualified registry, or health IT vendor must be able to indicate its data source.

(D) If the clinician chooses to opt-in in accordance with § 414.1310, the third party intermediary must be able to transmit that decision to CMS.

(E) The third party intermediary must provide services throughout the entire performance period and applicable data submission period.

(F) Prior to discontinuing services to any MIPS eligible clinician, group, or virtual group during a performance period, the third party intermediary must support the transition of such MIPS eligible clinician, group, or virtual group to an alternate third party intermediary, submitter type, or, for any measure on which data has been collected, collection type according to a CMS approved a transition plan.

(ii) The determination of whether to approve an entity as a third party intermediary for a MIPS payment year may take into account:

(A) Whether the entity failed to comply with the requirements of this section for any prior MIPS payment year for which it was approved as third party intermediary; and

(B) Whether the entity provided inaccurate information regarding the requirements of this subpart to any eligible clinician.

(iii) Beginning with the 2023 MIPS payment year, third party intermediaries must attend and complete training and support sessions in the form and manner, and at the times, specified by CMS.

(5) All data submitted to CMS by a third party intermediary on behalf of a MIPS eligible clinician, group or virtual group must be certified by the third party intermediary as true, accurate, and complete to the best of its knowledge. Such certification must be made in a form and manner and at such time as specified by CMS.

(b) QCDRs. - (1) QCDR self-nomination. For the 2020 and 2021 MIPS payment years, entities seeking to qualify as a QCDR must self-nominate September 1 until November 1 of the CY preceding the applicable performance period. For the 2022 MIPS payment year and future years, entities seeking to qualify as a QCDR must self-nominate during a 60-day period during the CY preceding the applicable performance period (beginning no earlier than July 1 and ending no later than September 1). Entities seeking to qualify as a QCDR for a performance period must provide all information required by CMS at the time of self-nomination and must provide any additional information requested by CMS during the review process. For the 2021 MIPS payment year and future years, existing QCDRs that are in good standing may attest that certain aspects of their previous year's approved self-nomination have not changed and will be used for the applicable performance period. Beginning with the 2023 payment year, QCDRs are required to attest during the self-nomination process that they can provide performance feedback at least 4 times a year (as specified at paragraph (b)(2)(iv) of this section), and if not, provide sufficient rationale as to why they do not believe they would be able to meet this requirement. Each QCDR would still be required to submit notification to CMS within the reporting period promptly within the month of realization of the impending deficiency in order to be considered for this exception, as discussed at paragraph (b)(2)(iv) of this section.

(2) QCDR conditions for approval. In addition to the other requirements in this section, the criteria for an entity to be approved as a QCDR include the following: (i) Beginning with the 2022 MIPS Payment Year, the QCDR must have at least 25 participants by January 1 of the year prior to the applicable performance period.

(ii) If the entity uses an external organization for purposes of data collection, calculation, or transmission, it must have a signed, written agreement with the external organization that specifically details the responsibilities of the entity and the external organization. The written agreement must be effective as of September 1 of the year preceding the applicable performance period.

(iii) Beginning with the 2023 MIPS payment year, require QCDRs to provide performance feedback to their clinicians and groups at least 4 times a year, and provide specific feedback to their clinicians and groups on how they compare to other clinicians who have submitted data on a given measure within the QCDR. Exceptions to this requirement may occur if the QCDR does not receive the data from their clinician until the end of the performance period.

(iv) Beginning with the 2023 payment year, the QCDR must conduct annual data validation audits in accordance with this paragraph (b)(2)(iv).

(A) The QCDR must conduct data validation for the payment year prior to submitting any data for that payment year to CMS for purposes of the MIPS program.

(B) The QCDR must conduct data validation on data for each performance category for which it will submit data, including if applicable the Quality, Improvement Activities, and Promoting Interoperability performance categories.

(C) The QCDR must conduct data validation on data for each submitter type for which it will submit data, including if applicable MIPS eligible clinicians, groups, virtual groups, voluntary participants, and opt-in participants.

(D) The QCDR must use clinical documentation (provided by the clinicians they are submitting data for) to validate that the action or outcome measured actually occurred or was performed.

(E) The QCDR shall conduct each data validation audit using a sampling methodology that meets the following requirements:

(1) Uses a sample size of at least 3 percent of the TIN/NPIs for which the QCDR will submit data to CMS, except that if a 3 percent sample size would result in fewer than 10 TIN/NPIs, the QCDR must use a sample size of at least 10 TIN/NPIs, and if a 3 percent sample size would result in more than 50 TIN/NPIs, the QCDR may use a sample size of 50 TIN/NPIs.

(2) Uses a sample that includes at least 25 percent of the patients of each TIN/NPI in the sample, except that the sample for each TIN/NPI must include a minimum of 5 patients and does not need to include more than 50 patients.

(F) Each QCDR data validation audit must include the following:

(1) Verification of the eligibility status of each eligible clinician, group, virtual group, opt-in participant, and voluntary participant.

(2) Verification of the accuracy of TINs and NPIs.

(3) Calculation of reporting and performance rates.

(4) Verification that only the MIPS quality measures and QCDR measures, as applicable, that are relevant to the performance period will be used for MIPS submission.

(G) In a form and manner and by a deadline specified by CMS, the QCDR must report the results of each data validation audit, including the overall data deficiencies or data error rate, the types of deficiencies or data errors discovered, the percentage of clinicians impacted by any deficiency or error, and, how and when each deficiency or data error type was corrected.

(v) Beginning with the 2023 MIPS payment year, the QCDR must conduct targeted audits in accordance with this this paragraph (b)(2)(v).

(A) If a data validation audit under paragraph (b)(2)(iv) of this section identifies one or more deficiency or data error, the QCDR must conduct a targeted audit into the impact and root cause of each such deficiency or data error for that MIPS payment year.

(B) The QCDR must conduct any required targeted audits for the MIPS payment year and correct any deficiencies or data errors identified through such audit prior to the submission of data for that MIPS payment year.

(C) The QCDR must conduct the targeted audit using the sampling methodology that meets the requirements described in paragraph (b)(2)(iv)(E) of this section. The sample for the targeted audit must not include data from the sample used for the data validation audit in which the deficiency or data error was identified.

(D) In a form and manner and by a deadline specified by CMS, the QCDR must report the results of each targeted audit, including the overall deficiency or data error rate, the types of deficiencies or data errors discovered, the percentage of clinicians impacted by each deficiency or data error, and how and when each deficiency or data error type was corrected.

(3) QCDR measures for the quality performance category. (i) For purposes of QCDRs submitting data for the MIPS quality performance category, CMS considers the following types of quality measures to be QCDR measures:

(A) Measures that are not included in the MIPS final list of quality measures described in § 414.1330(a)(1) for the applicable MIPS payment year; and

(B) Measures that are included in the MIPS final list of quality measures described in § 414.1330(a)(1) for the applicable MIPS payment year, but have undergone substantive changes, as determined by CMS.

(ii) For the 2020 MIPS payment year and future years, an entity seeking to become a QCDR must submit specifications for each measure, activity, and objective that the entity intends to submit to for MIPS (including the information described in paragraphs (b)(3)(ii)(A) and (B) of this section) at the time of self-nomination. In addition, no later than 15 calendar days following CMS approval of any QCDR measure specifications, the entity must publicly post the measure specifications for each QCDR measure (including the CMS-assigned QCDR measure ID) and provide CMS with a link to where this information is posted.

(A) For QCDR measures, the entity must submit the measure specifications for each QCDR measure, including: Name/title of measures, NQF number (if NQF-endorsed), descriptions of the denominator, numerator, and when applicable, denominator exceptions, denominator exclusions, risk adjustment variables, and risk adjustment algorithms.

(B) For MIPS quality measures, the entity must submit the MIPS measure IDs and specialty-specific measure sets, as applicable.

(iii) A QCDR must include the CMS-assigned QCDR measure ID when submitting data on any QCDR measure to CMS.

(iv) QCDR measure considerations for approval include:

(A) Preference for measures that are outcome-based rather than clinical process measures.

(B) Measures that address patient safety and adverse events.

(D) Measures that address the domain of care coordination.

(E) Measures that address the domain for patient and caregiver experience.

(F) Measures that address efficiency, cost, and resource use.

(G) Beginning with the 2021 performance period -

(1) That QCDRs link their QCDR measures as feasible to at least one of the following at the time of self-nomination:

(i) Cost measure;

(ii) Improvement activity; or

(iii) An MVP.

(2) In cases where a QCDR measure does not have a clear link to a cost measure, improvement activity, or an MVP, we would consider exceptions if the potential QCDR measure otherwise meets the QCDR measure requirements and considerations.

(H) Beginning with the 2020 performance period CMS may consider the extent to which a QCDR measure is available to MIPS eligible clinicians reporting through QCDRs other than the QCDR measure owner for purposes of MIPS. If CMS determines that a QCDR measure is not available to MIPS eligible clinicians, groups, and virtual groups reporting through other QCDRs, CMS may not approve the measure.

(I) We give greater consideration to measures for which QCDRs:

(1) Conducted an environmental scan of existing QCDR measures; MIPS quality measures; quality measures retired from the legacy Physician Quality Reporting System (PQRS) program; and

(2) Utilized the CMS Quality Measure Development Plan Annual Report and the Blueprint for the CMS Measures Management System to identify measurement gaps prior to measure development.

(J) Beginning with the 2020 performance period, we place greater preference on QCDR measures that meet case minimum and reporting volumes required for benchmarking after being in the program for 2 consecutive CY performance periods. Those that do not, may not continue to be approved.

(1) Beginning with the 2020 performance period, in instances where a QCDR believes the low-reported QCDR measure that did not meet benchmarking thresholds is still important and relevant to a specialist's practice, that the QCDR may develop and submit a QCDR measure participation plan for our consideration. This QCDR measure participation plan must include the QCDR's detailed plans and changes to encourage eligible clinicians and groups to submit data on the low-reported QCDR measure for purposes of the MIPS program.

(2) [Reserved]

(v) QCDR measure requirements for approval include:

(A) QCDR Measures that are beyond the measure concept phase of development.

(B) QCDR Measures that address significant variation in performance.

(C) Beginning with the 2022 performance period, all QCDR measures must be fully developed and tested, with complete testing results at the clinician level, prior to submitting the QCDR measure at the time of self-nomination.

(1) To be approved for the 2024 MIPS payment year, a QCDR measure must be face valid. To be approved for the 2025 MIPS payment year and future years, a QCDR measure must be face valid for the initial MIPS payment year for which it is approved and fully tested for any subsequent MIPS payment year for which it is approved.

(2) To be included in an MIPS Value Pathway for the 2024 MIPS payment year and future years, a QCDR measure must be fully tested.

(D) Beginning with the 2022 performance period, QCDRs are required to collect data on a QCDR measure, appropriate to the measure type, prior to submitting the QCDR measure for CMS consideration during the self-nomination period.

(E) Beginning with the 2022 MIPS payment year, CMS may provisionally approve the individual QCDR measures for 1 year with the condition that QCDRs address certain areas of duplication with other approved QCDR measures or MIPS quality measures in order to be considered for the program in subsequent years. If such areas of duplication are not addressed, CMS may reject the duplicative QCDR measure.

(vi) Beginning with the 2023 MIPS payment year, QCDR measures may be approved for 2 years, at CMS discretion by attaining approval status by meeting QCDR measure considerations and requirements. Upon annual review, CMS may revoke a QCDR measure's second year approval, if the QCDR measure is found to be: Topped out; duplicative of a more robust measure; reflects an outdated clinical guideline; or if the QCDR self-nominating the QCDR measure is no longer in good standing.

(vii) Beginning with the 2020 performance period, QCDR measure rejection criteria considerations include, but are not limited to, the following factors:

(A) QCDR measures that are duplicative, or identical to other QCDR measures or MIPS quality measures that are currently in the program.

(B) QCDR measures that are duplicative or identical to MIPS quality measures that have been removed from MIPS through rulemaking.

(C) QCDR measures that are duplicative or identical to quality measures used under the legacy Physician Quality Reporting System (PQRS) program, which have been retired.

(D) QCDR measures that meet the topped out definition as described at § 414.1305.

(E) QCDR measures that are process-based, with consideration to whether the removal of the process measure impacts the number of measures available for a specific specialty.

(F) Whether the QCDR measure has potential unintended consequences to a patient's care.

(G) Considerations and evaluation of the measure's performance data, to determine whether performance variance exists.

(H) QCDR measures that split a single clinical practice or action into several QCDR measures.

(I) QCDR measures that are “check-box” with no actionable quality action.

(J) QCDR measures that do not meet the case minimum and reporting volumes required for benchmarking after being in the program for 2 consecutive years.

(K) QCDR measures with clinician attribution issues, where the quality action is not under the direct control of the reporting clinician.

(L) QCDR measures that focus on rare events or “never events” in the measurement period.

(c) Qualified registries. - (1) Qualified registry self-nomination. For the 2020 and 2021 MIPS payment years, entities seeking to qualify as a qualified registry must self-nominate from September 1 until November 1 of the CY preceding the applicable performance period. For the 2022 MIPS payment year and future years, entities seeking to qualify as a qualified registry must self-nominate during a 60-day period during the CY preceding the applicable performance period (beginning no earlier than July 1 and ending no later than September 1). Entities seeking to qualify as a qualified registry for a performance period must provide all information required by CMS at the time of self-nomination and must provide any additional information requested by CMS during the review process. For the 2021 MIPS payment year and future years, existing qualified registries that are in good standing may attest that certain aspects of their previous year's approved self-nomination have not changed and will be used for the applicable performance period. Beginning with the 2023 payment year, qualified registries are required to attest during the self-nomination process that they can provide performance feedback at least 4 times a year (as specified at § 414.1400(c)(2)(ii)), and if not, provide sufficient rationale as to why they do not believe they would be able to meet this requirement. Each qualified registry would still be required to submit notification to CMS within the reporting period promptly within the month of realization of the impending deficiency in order to be considered for this exception, as discussed at § 414.1400(c)(2)(ii).

(2) Establishment of a qualified registry entity. Beginning with the 2022 MIPS Payment Year, the qualified registry must have at least 25 participants by January 1 of the year prior to the applicable performance period.

(i) Beginning with the 2022 MIPS Payment Year, the qualified registry must have at least 25 participants by January 1 of the year prior to the applicable performance period.

(ii) Beginning with the 2023 MIPS payment year, require qualified registries to provide performance feedback to their clinicians and groups at least 4 times a year, and provide specific feedback to their clinicians and groups on how they compare to other clinicians who have submitted data on a given measure within the qualified registries. Exceptions to this requirement may occur if the qualified registries does not receive the data from their clinician until the end of the performance period.

(iii) Beginning with the 2023 payment year, the qualified registry must conduct annual data validation audits in accordance with this paragraph (c)(2)(iii).

(A) The qualified registry must conduct their data validation audits prior to submitting any data to CMS for purposes of the MIPS program.

(B) The qualified registry must conduct data validation on data for each performance category for which it will submit data, including if applicable the Quality, Improvement Activities, and Promoting Interoperability performance categories.

(C) The qualified registry must conduct data validation on data for each submitter type for which it will submit data, including if applicable MIPS eligible clinicians, groups, virtual groups, voluntary participants, and opt-in participants.

(D) The qualified registry must use clinical documentation (provided by the clinicians they are submitting data for) to validate that the action or outcome measured actually occurred or was performed.

(E) The qualified registry shall conduct each data validation audit using a sampling methodology that meets the following:

(1) Uses a sample size of at least 3 percent of the TIN/NPIs for which the qualified registry will submit data to CMS, except that if a 3 percent sample size would result in fewer than 10 TIN/NPIs, the qualified registry must use a sample size of at least 10 TIN/NPIs, and if a 3 percent sample size would result in more than 50 TIN/NPIs, the qualified registry may use a sample size of 50 TIN/NPIs.

(F) Each qualified registry data validation audit must include the following:

(1) Verification of the eligibility status of each eligible clinician, group, virtual group, opt-in participant, and voluntary participant.

(2) Verification of the accuracy of TINs and NPIs.

(3) Calculation of reporting and performance rates.

(4) Verification that only MIPS quality measures and qualified registry measures that are relevant to the performance period will be utilized for MIPS submission.

(G) In a form and manner and by a deadline specified by CMS, the qualified registry must report data validation results, including the overall deficiency or data error rate, the types of deficiencies or data errors discovered, the percentage of clinicians impacted by any deficiency or data error, how and when each deficiency or data error type was corrected.

(iv) Beginning with the 2023 MIPS payment year, the qualified registry must conduct targeted audits in accordance with this paragraph (c)(2)(iv).

(A) If a data validation audit under paragraph (c)(2)(iii) of this section identifies one or more deficiency or data error, the qualified registry must conduct a targeted audit into the impact and root cause of each such deficiency or data error for that MIPS payment year.

(B) The qualified registry must conduct any required targeted audits for the MIPS payment year and correct any deficiencies or data errors identified through such audit prior to the submission of data for that MIPS payment year.

(C) The qualified registry must conduct the targeted audit using the sampling methodology that meets the requirements described in paragraphs (c)(2)(iii)(E)(1) and (2) of this section. The sample for the targeted audit must not include data from the sample used for the data validation audit in which the deficiency or data error was identified.

(D) In a form and manner and by a deadline specified by CMS, the qualified registry must report the results of each targeted audit, including the overall deficiency or data error rate, the types of deficiencies or data errors discovered, the percentage of clinicians impacted by each deficiency or data error, how and when each deficiency or data error type was corrected.

(d) Health IT vendor approval criteria. Health IT vendors must meet the criteria specified at paragraph (a)(4) of this section.

(e) CMS-approved survey vendor approval criteria. Entities seeking to be a CMS-approved survey vendor for any MIPS performance period must submit a survey vendor application to CMS in a form and manner specified by CMS for each MIPS performance period for which it wishes to transmit such data. The application and any supplemental information requested by CMS must be submitted by deadlines specified by CMS. For an entity to be a CMS-approved survey vendor, it must meet the following criteria:

(1) The entity must have sufficient experience, capability, and capacity to accurately report CAHPS data, including:

(i) At least 3 years of experience administering mixed-mode surveys (that is, surveys that employ multiple modes to collect date), including mail survey administration followed by survey administration via Computer Assisted Telephone Interview (CATI);

(ii) At least 3 years of experience administering surveys to a Medicare population;

(iii) At least 3 years of experience administering CAHPS surveys within the past 5 years;

(iv) Experience administering surveys in English and at least one other language for which a translation of the CAHPS for MIPS survey is available;

(v) Use equipment, software, computer programs, systems, and facilities that can verify addresses and phone numbers of sampled beneficiaries, monitor interviewers, collect data via CATI, electronically administer the survey and schedule call-backs to beneficiaries at varying times of the day and week, track fielded surveys, assign final disposition codes to reflect the outcome of data collection of each sampled case, and track cases from mail surveys through telephone follow-up activities; and

(vi) Employment of a program manager, information systems specialist, call center supervisor and mail center supervisor to administer the survey.

(2) The entity has certified that it has the ability to maintain and transmit quality data in a manner that preserves the security and integrity of the data.

(3) The entity has successfully completed, and has required its subcontractors to successfully complete, vendor training(s) administered by CMS or its contractors.

(4) The entity has submitted a quality assurance plan and other materials relevant to survey administration, as determined by CMS, including cover letters, questionnaires and telephone scripts.

(5) The entity has agreed to participate and cooperate, and has required its subcontractors to participate and cooperate, in all oversight activities related to survey administration conducted by CMS or its contractors.

(6) The entity has sent an interim survey data file to CMS that establishes the entity's ability to accurately report CAHPS data.

(f) Remedial action and termination of third party intermediaries. (1) If CMS determines that a third party intermediary has ceased to meet one or more of the applicable criteria for approval, has submitted a false certification under paragraph (a)(5) of this section, or has submitted data that are inaccurate, unusable, or otherwise compromised, CMS may take one or more of the following remedial actions after providing written notice to the third party intermediary:

(i) Require the third party intermediary to submit a corrective action plan (CAP) by a date specified by CMS. The CAP must address the following issues, unless different or additional information is specified by CMS:

(A) The issues that contributed to the non-compliance.

(B) The impact to individual clinicians, groups, or virtual groups, regardless of whether they are participating in the program because they are MIPS eligible, voluntary participating, or opting in to participating in the MIPS program.

(C) The corrective actions to be implemented by the third party intermediary to ensure that the non-compliance has been resolved and will not recur in the future.

(D) The detailed timeline for achieving compliance with the applicable requirements.

(ii) Publicly disclose the entity's data error rate on the CMS website until the data error rate falls below 3 percent.

(2) CMS may immediately or with advance notice terminate the ability of a third party intermediary to submit MIPS data on behalf of a MIPS eligible clinician, group, or virtual group for one or more of the following reasons:

(i) CMS has grounds to impose remedial action;

(ii) CMS has not received a CAP within the specified time period or the CAP is not accepted by CMS; or

(iii) The third party intermediary fails to correct the deficiencies or data errors by the date specified by CMS.

(3) For purposes of paragraph (f) of this section, CMS may determine that submitted data are inaccurate, unusable, or otherwise compromised, including but not limited to, if the submitted data:

(i) Includes, without limitation, TIN/NPI mismatches, formatting issues, calculation errors, or data audit discrepancies; and

(ii) Affects more than 3 percent of the total number of MIPS eligible clinicians or group for which data was submitted by the third party intermediary.

(g) Auditing of entities submitting MIPS data. Any third party intermediary must comply with the following procedures as a condition of its qualification and approval to participate in MIPS as a third party intermediary.

(1) The entity must make available to CMS the contact information of each MIPS eligible clinician or group on behalf of whom it submits data. The contact information must include, at a minimum, the MIPS eligible clinician or group's practice phone number, address, and, if available, email.

(2) The entity must retain all data submitted to CMS for purposes of MIPS for 6 years from the end of the MIPS performance period.

(3) For the purposes of auditing, CMS may request any records or data retained for the purposes of MIPS for up to 6 years from the end of the MIPS performance period.

[83 FR 60088, Nov. 23, 2018, as amended at 84 FR 63198, Nov. 15, 2019; 85 FR 27623, May 8, 2020; 85 FR 85033, Dec. 28, 2020; 86 FR 9472, Feb. 16, 2021]