§ 512.665 Data sharing with CJR-X participants.
(a) General. CMS shares certain beneficiary-identifiable data as described in paragraphs (b), (c), and (e) of this section and certain regional aggregate data as described in paragraph (d) of this section with CJR-X participants regarding CJR-X beneficiaries and performance under the model, consistent with applicable law.
(b) Beneficiary-identifiable claims data. CMS shares beneficiary-identifiable claims data with CJR-X participants as follows:
(1) CMS makes available certain beneficiary-identifiable claims data described in paragraph (5) of this section for CJR-X participants to request for purposes of conducting health care operations work that falls within paragraph (1) or (2) of the definition of health care operations at 45 CFR 164.501 regarding their CJR-X beneficiaries.
(2) A CJR-X participant that wishes to receive beneficiary-identifiable claims data for its CJR-X beneficiaries must:
(i) Submit a formal request for the data on an annual basis in a manner and form and by a date specified by CMS, indicating their selection of summary beneficiary-identifiable data, raw beneficiary-identifiable data, or both, and attest that—
(A) The CJR-X participant is requesting claims data of CJR-X beneficiaries who would be in an episode during the baseline period or performance year, as a HIPAA covered entity.
(B) The CJR-X participant's request reflects the minimum data necessary, as set forth in paragraph (c) of this section, for the CJR-X participant to conduct health care operations work that falls within the first or second paragraph of the definition of health care operations at 45 CFR 164.501.
(C) The CJR-X participant's use of claims data will be limited to developing processes and engaging in appropriate activities related to coordinating care, improving the quality and efficiency of care, and conducting population-based activities relating to improving health or reducing health care costs that are applied uniformly to all CJR-X beneficiaries, in an episode during the baseline period or performance year, and that these data will not be used to reduce, limit or restrict care for specific Medicare beneficiaries.
(ii) Sign and submit a CJR-X data sharing agreement, as defined in § 512.605, with CMS as set forth in paragraph (e) of this section.
(3) CMS shares this beneficiary-identifiable claims data with a CJR-X participant in accordance with applicable privacy and security laws and established privacy and security protections.
(4) CMS omits from the beneficiary-identifiable claims data any information that is subject to the regulations in 42 CFR part 2 governing the confidentiality of substance use disorder patient records.
(5) The beneficiary-identifiable claims data will include, when available, the following:
(i) Unrefined (raw) Medicare Parts A and B beneficiary-identifiable claims data for CJR-X beneficiaries in an episode during the 3-year baseline period and performance year.
(ii) Summarized (summary) Medicare Parts A and B beneficiary-identifiable claims data for CJR-X beneficiaries in an episode during the 3-year baseline period and applicable performance year.
(6) CMS makes available the beneficiary-identifiable claims data for retrieval by CJR-X participants at the following frequency:
(i) Annually, at least one month prior to every performance year for baseline period data, based on the baseline periods described in § 512.640(b)(2).
(ii) As frequently as monthly during the performance year and for up to 6 months after the performance year for performance year data.
(c) Minimum necessary data. The CJR-X participant must limit its request for beneficiary-identifiable data under paragraph (b) of this section to the minimum necessary Parts A and B data elements which may include, but are not limited to the following:
(1) Medicare beneficiary identifier (ID).
(2) Procedure code.
(3) Sex.
(4) Diagnosis code.
(5) Claim ID.
(6) The from and through dates of service.
(7) The provider or supplier ID.
(8) The claim payment type.
(9) Date of birth and death, if applicable.
(10) Tax identification number.
(11) National provider identifier.
(d) Regional aggregate data.
(1) CMS shares regional aggregate data for the 3-year baseline period and relevant performance year with CJR-X participants as follows.
(i) CMS shares 3-year baseline period regional aggregate data annually at least 1 month before the relevant performance year, based on the baseline periods described in § 512.640(b)(2).
(ii) CMS shares performance year regional aggregate data as frequently as a monthly basis during the applicable performance year and for up to 6 months after the relevant performance year.
(2) Regional aggregate data will—
(i) Be aggregated based on all Parts A and B claims associated with episodes in CJR-X for the U.S. Census Division in which the CJR-X participant is located;
(ii) Summarize average episode spending for episodes in CJR-X in the U.S. Census Division in which the CJR-X participant is located; and
(iii) Be de-identified in accordance with 45 CFR 164.514(b).
(e) CJR-X data sharing agreement.
(1) A CJR-X participant who wishes to retrieve the beneficiary-identifiable data specified in paragraph (b) of this section, must complete and submit, on at least an annual basis, a signed CJR-X data sharing agreement, as defined in § 512.605, to be provided in a form and manner and by a date specified by CMS, under which the CJR-X participant agrees:
(i) To comply with the requirements for use and disclosure of this beneficiary-identifiable data that are imposed on covered entities by the HIPAA Privacy Rule (45 CFR part 160 and subparts A and E of part 164), HIPAA Breach Notification Rule (45 CFR subpart D of part 164) and the requirements of the CJR-X set forth in this part.
(ii) To comply with additional privacy, security, breach notification, and data retention requirements specified by CMS in the CJR-X data sharing agreement.
(iii) To contractually bind each downstream recipient of the beneficiary-identifiable data that is a business associate of the CJR-X participant to the same terms and conditions to which the CJR-X participant is itself bound in its CJR-X data sharing agreement with CMS as a condition of the business associate's receipt of the beneficiary-identifiable data retrieved by the CJR-X participant under the CJR-X.
(iv) That if the CJR-X participant misuses or discloses the beneficiary-identifiable data in a manner that violates any applicable statutory or regulatory requirements or that is otherwise non-compliant with the provisions of the data sharing agreement, CMS may deem the CJR-X participant ineligible to retrieve beneficiary-identifiable data under paragraph (b) of this section for any amount of time, and the CJR-X participant may be subject to additional sanctions and penalties available under the law.
(2) A CJR-X participant must comply with all applicable laws and the terms of the CJR-X data sharing agreement in order to retrieve the beneficiary-identifiable data.