42 U.S.C. § 1395kk–2 — Expanding availability of Medicare data

(a) Expanding uses of Medicare data by qualified entities

(1) Additional analyses.

(A) In general. Subject to subparagraph (B), and only as far as applicable information, privacy, security, and disclosure laws allow, a qualified entity may, beginning July 1, 2016, use the combined data described in section 1874(e)(4)(B)(iii) of the Social Security Act that it received under that section. It may also use information derived from the evaluation described in section 1874(e)(4)(D). The qualified entity may use these materials to conduct additional non-public analyses, as the Secretary considers appropriate, and may provide or sell those analyses to authorized users for non-public use. This includes helping providers of services and suppliers develop and take part in quality and patient-care improvement activities, including developing new care models. This permission applies despite section 1874(e)(4)(B) and the second sentence of section 1874(e)(4)(D) of the Social Security Act.

(B) Limitations with respect to analyses.

(i) Employers. An analysis provided or sold under subparagraph (A) to an employer described in paragraph (9)(A)(iii) may be used by that employer only to provide health insurance to its employees and retirees.

(ii) Health insurance issuers. A qualified entity may not provide or sell an analysis to a health insurance issuer^* described in paragraph (9)(A)(iv) unless that issuer is providing the qualified entity with data under section 1874(e)(4)(B)(iii) of the Social Security Act.

(2) Access to certain data.

(A) Access. To the extent allowed by applicable information, privacy, security, and disclosure laws, and beginning July 1, 2016, a qualified entity may do either of the following. These permissions apply despite section 1874(e)(4)(B) and the second sentence of section 1874(e)(4)(D) of the Social Security Act:

(i) It may provide or sell the combined data described in section 1874(e)(4)(B)(iii) of that Act to the authorized users listed in paragraph (9)(A)(i), (ii), and (v), for non-public use, including the purposes in subparagraph (B).

(ii) Subject to subparagraph (C), it may provide Medicare claims data to those same authorized users for non-public use, including the purposes in subparagraph (B).

(B) Purposes described. The purposes are helping providers of services and suppliers develop and take part in quality and patient-care improvement activities, including developing new care models.

(C) Medicare claims data must be provided at no cost. A qualified entity may not charge for providing data under subparagraph (A)(ii).

(3) Protection of information.

(A) In general. Except as subparagraph (B) allows, an analysis or data provided or sold under paragraph (1) or (2) may not contain information that individually identifies a patient.

(B) Information on patients of the provider of services or supplier. As far as applicable information, privacy, security, and disclosure laws allow, an analysis or data provided or sold to a provider of services or supplier under paragraph (1) or (2) may contain information that individually identifies that provider’s or supplier’s patient. This may include information about items or services that other providers or suppliers gave the patient.

(C) Prohibition on using analyses or data for marketing purposes. An authorized user may not use an analysis or data provided or sold under paragraph (1) or (2) for marketing.

(4) Data use agreement. A qualified entity and an authorized user listed in paragraph (9)(A)(i), (ii), or (v) must enter into an agreement about using data that the qualified entity provides or sells to the authorized user under paragraph (2). The agreement must describe the data’s privacy and security requirements. As the Secretary considers appropriate, it must also describe any bans on using the data to link it with other sources of individually identifiable information. If the authorized user is not a covered entity under rules issued under the Health Insurance Portability and Accountability Act of 1996, the agreement must identify the relevant regulations^*, as the Secretary determines them, that the user must follow as though it were acting as a covered entity.

(5) No redisclosure of analyses or data.

(A) In general. Except as subparagraph (B) allows, an authorized user that receives or buys an analysis or data under paragraph (1) or (2) may not disclose it again, make it public, or make public any analysis that uses the data.

(B) Permitted redisclosure. A provider of services or supplier that receives or buys an analysis or data under paragraph (1) or (2) may, as the Secretary determines, disclose it again for performance-improvement and care-coordination activities. It may not make the analysis or data public, or make public any analysis using the data.

(6) Opportunity for providers of services and suppliers to review. Before a qualified entity provides or sells an analysis under paragraph (1) to an authorized user, the qualified entity must give a provider of services or supplier an opportunity to appeal and correct errors in the way described in section 1874(e)(4)(C)(ii) of the Social Security Act, if the analysis would individually identify that provider or supplier and that provider or supplier is not receiving or buying the analysis.

(7) Assessment for a breach.

(A) In general. If someone breaches a data-use agreement under this section or section 1874(e) of the Social Security Act, the Secretary must impose an assessment on the qualified entity in both situations:

(i) an agreement between the Secretary and a qualified entity; and

(ii) an agreement between a qualified entity and an authorized user.

(B) Assessment. The assessment may be up to $100 for each individual who is entitled to or enrolled for Part A benefits under title XVIII of the Social Security Act, or enrolled for Part B benefits under that title:

(i) for an agreement described in subparagraph (A)(i), each individual about whom the Secretary provided data to the qualified entity under paragraph (2); and

(ii) for an agreement described in subparagraph (A)(ii), each individual about whom the qualified entity provided data to the authorized user under paragraph (2).

(C) Deposit of amounts collected. Money collected under this paragraph must be deposited in the Federal Supplementary Medical Insurance Trust Fund under section 1841 of the Social Security Act.

(8) Annual reports. A qualified entity that provides or sells an analysis or data under paragraph (1) or (2) must send the Secretary an annual report containing:

(A) a summary of the analyses provided or sold, including their number, the number of purchasers, and the total fees received for them;

(B) a description of the analyses’ topics and purposes;

(C) information about the entities that received data under paragraph (2), how they used it, and the total fees received for providing, selling, or sharing it; and

(D) other information the Secretary considers appropriate.

(9) Definitions. In this subsection and subsection (b):

(A) Authorized user. “Authorized user” means:

(i) a provider of services;

(ii) a supplier;

(iii) an employer, as defined in section 1002(5) of title 29;

(iv) a health insurance issuer, as defined in section 300gg–91;

(v) a medical society or hospital association; or

(vi) another entity not described in clauses (i) through (v) that the Secretary approves. This does not include an employer or health insurance issuer not described in clauses (iii) and (iv), respectively, as the Secretary determines. This section does not define “provider of services,” “supplier,” “employer,” “health insurance issuer,” “medical society,” “hospital association,” or “entity” except by the cross-references stated here.

(B) Provider of services. “Provider of services” has the meaning given in section 1861(u) of the Social Security Act. This section does not define that term.

(C) Qualified entity. “Qualified entity” has the meaning given in section 1874(e)(2) of the Social Security Act. This section does not define that term.

(D) Secretary. “Secretary” means the Secretary of Health and Human Services.

(E) Supplier. “Supplier” has the meaning given in section 1861(d) of the Social Security Act. This section does not define that term.

(b) Access to Medicare data by qualified clinical data registries to facilitate quality improvement

(1) Access.

(A) In general. As far as applicable information, privacy, security, and disclosure laws allow, beginning July 1, 2016, the Secretary must, at the request of a qualified clinical data registry under section 1848(m)(3)(E) of the Social Security Act, provide the data described in subparagraph (B) to that registry. The Secretary may choose the form and manner of providing it. The registry may use the data to link it with clinical-outcomes data and to conduct risk-adjusted, scientifically valid analyses and research supporting quality improvement or patient safety. If such analyses or research publicly identify a provider of services or supplier, the provider or supplier must first have an opportunity to appeal and correct errors in the way described in subsection (a)(6).

(B) Data described. The data are:

(i) claims data under the Medicare program under title XVIII of the Social Security Act; and

(ii) if the Secretary considers it appropriate, claims data under the Medicaid program under title XIX of that Act and the State^* Children’s Health Insurance Program under title XXI of that Act.

(2) Fee. The data described in paragraph (1)(B) must be provided to a qualified clinical data registry under paragraph (1) for a fee equal to the cost of providing the data. Any fee collected under this sentence must be deposited in the Centers for Medicare & Medicaid Services Program Management Account.