(a) CMS shares aggregate reports with the ACO.

(b) CMS shares beneficiary identifiable data with ACOs on the condition that the ACO, its ACO participants, ACO providers/suppliers, and other individuals or entities performing functions or services related to the ACO's activities observe all relevant statutory and regulatory provisions regarding the appropriate use of data and the confidentiality and privacy of individually identifiable health information and comply with the terms of the data use agreement described in this subpart.

(c) The ACO must not limit or restrict appropriate sharing of medical record data with providers and suppliers both within and outside the ACO in accordance with applicable law.

CMS shares aggregate reports with ACOs as follows:

(a) Aggregate reports are shared at the start of the agreement period based on beneficiary claims data used to calculate the benchmark, and each quarter thereafter during the agreement period.

(b) These aggregate reports include, when available, the following information, deidentified in accordance with 45 CFR 164.514(b):

(1) Aggregated metrics on the assigned beneficiary population.

(2) Utilization and expenditure data at the start of the agreement period based on historical beneficiaries used to calculate the benchmark.

(c)(1)(i) For performance years 2012 through 2015, at the beginning of the agreement period, during each quarter (and in conjunction with the annual reconciliation), and at the beginning of each performance year, CMS, upon the ACO's request for the data for purposes of population-based activities relating to improving health or reducing growth in health care costs, process development, case management, and care coordination, will provide the ACO with information regarding preliminarily prospectively assigned beneficiaries whose data was used to generate the aggregate data reports under paragraphs (a) and (b) of this section. The information includes the following:

(A) Beneficiary name.

(B) Date of birth.

(C) HICN.

(D) Sex.

(ii) For performance year 2016 and subsequent performance years, at the beginning of the agreement period, during each quarter (and in conjunction with the annual reconciliation), and at the beginning of each performance year, CMS, upon the ACO's request for the data for purposes of population-based activities relating to improving health or reducing growth in health care costs, protocol development, case management, and care coordination, provides the ACO with information about its fee-for-service population.

(A) For an ACO participating under preliminary prospective assignment with retrospective reconciliation as specified under § 425.400(a)(2), the following information is made available regarding preliminarily prospectively assigned beneficiaries and beneficiaries that received a primary care service during the previous 12 months from one of the ACO participants that submits claims for primary care services used to determine the ACO's assigned population under subpart E of this part:

(1) Beneficiary name.

(2) Date of birth.

(3) Beneficiary identifier.

(4) Sex.

(B) For an ACO participating under preliminary prospective assignment with retrospective reconciliation as specified under § 425.400(a)(2), information in the following categories, which represents the minimum data necessary for ACOs to conduct health care operations work, is made available regarding preliminarily prospectively assigned beneficiaries:

(1) Demographic data such as enrollment status.

(2) Health status information such as risk profile and chronic condition subgroup.

(3) Utilization rates of Medicare services such as the use of evaluation and management, hospital, emergency, and post-acute services, including the dates and place of service.

(4) Expenditure information related to utilization of services.

(C) The information under paragraphs (c)(1)(ii)(A) and (B) of this section is made available to ACOs participating under prospective assignment as specified under § 425.400(a)(3), but is limited to the ACO's prospectively assigned beneficiaries.

(iii) For performance year 2024 and subsequent performance years, CMS, upon the ACO's request for the data for purposes of population-based activities relating to improving health or reducing growth in health care costs, protocol development, case management, and care coordination, provides the ACO with information about its fee-for-service population.

(A) The following information is made available to ACOs regarding beneficiaries eligible for Medicare CQMs as defined at § 425.20:

(1) Beneficiary name.

(2) Date of birth.

(3) Beneficiary identifier.

(4) Sex.

(B) Information in the following categories, which represents the minimum data necessary for ACOs to conduct health care operations work, is made available to ACOs regarding beneficiaries eligible for Medicare CQMs as defined at § 425.20:

(1) Demographic data such as enrollment status.

(2) Health status information such as risk profile and chronic condition subgroup.

(3) Utilization rates of Medicare services such as the use of evaluation and management, hospital, emergency, and post-acute services, including the dates and place of service.

(2) In its request for these data, the ACO must certify that it is seeking the following information:

(i) As a HIPAA-covered entity, and the request reflects the minimum data necessary for the ACO to conduct its own health care operations work that falls within the first or second paragraph of the definition of health care operations at 45 CFR 164.501.

(ii) As the business associate of its ACO participants and ACO providers/suppliers, who are HIPAA-covered entities, and the request reflects the minimum data necessary for the ACO to conduct health care operations work that falls within the first or second paragraph of the definition of health care operations at 45 CFR 164.501 on behalf of those participants.

(iii) As an organized health care arrangement (as defined at 45 CFR 160.103), and the request reflects the minimum data necessary for the ACO to conduct health care operations work that falls within the first or second paragraph of the definition of health care operations at 45 CFR 164.501 on behalf of the organized health care arrangement.

(d) For an ACO eligible to be reconciled under § 425.609(b), CMS shares with the ACO quarterly aggregate reports as provided in paragraphs (b) and (c)(1)(ii) of this section for CY 2019.

[76 FR 67973, Nov. 2, 2011, as amended at 80 FR 32844, June 9, 2015; 83 FR 60096, Nov. 23, 2018; 83 FR 68081, Dec. 31, 2018; 87 FR 70249, Nov. 18, 2022; 88 FR 79551, Nov. 16, 2023]

Subject to providing the beneficiary with the opportunity to decline data sharing as described in this § 425.708, and subject to having a valid DUA in place, CMS, upon the ACO's request for the data for purposes of evaluating the performance of its ACO participants or its ACO providers/suppliers, conducting quality assessment and improvement activities, and conducting population-based activities relating to improved health, will provide the ACO with beneficiary identifiable claims data for preliminarily prospectively and prospectively assigned beneficiaries and other beneficiaries who receive primary care services from an ACO participant that submits claims for primary care services used to determine the ACO's assigned population under subpart E of this part during the performance year.

(a) If an ACO wishes to receive beneficiary identifiable claims data, it must sign a DUA and it must submit a formal request for data. ACOs may access requested data as often as once per month.

(b) The ACO must certify that it is requesting claims data about any of the following:

(1) Its own patients, as a HIPAA-covered entity, and the request reflects the minimum data necessary for the ACO to conduct its own health care operations work that falls within the first or second paragraph of the definition of health care operations at 45 CFR 164.501.

(2) The patients of its HIPAA-covered entity ACO participants or its ACO providers/suppliers as the business associate of these HIPAA covered entities, and the request reflects the minimum data necessary for the ACO to conduct health care operations work that falls within the first or second paragraph of the definition of health care operations at 45 CFR 164.501 on behalf of those participants.

(3) The patients of the organized health care arrangement (as defined at 45 CFR 160.103) in which the ACO is participating with its ACO participants and ACO providers/suppliers, and the request reflects the minimum data necessary for the ACO to conduct health care operations work that falls within the first or second paragraph of the definition of health care operations at 45 CFR 164.501 on behalf of the organized health care arrangement.

(c) The use of identifiers and claims data will be limited to developing processes and engaging in appropriate activities related to coordinating care and improving the quality and efficiency of care that are applied uniformly to all Medicare beneficiaries with primary care services at the ACO, and that these data will not be used to reduce, limit or restrict care for specific beneficiaries.

(d) To ensure that beneficiaries have a meaningful opportunity to decline having their claims data shared with the ACO, the ACO may only request claims data about a beneficiary if—

(1) For an ACO participating under—

(i) Preliminary prospective assignment with retrospective reconciliation as specified under § 425.400(a)(2), the beneficiary's name appears on the preliminary prospective assignment list provided to the ACO at the beginning of the performance year, during each quarter (and in conjunction with the annual reconciliation) or the beneficiary has received a primary care service from an ACO participant upon whom assignment is based (under subpart E of this part) during the most recent 12-month period; or

(ii) Prospective assignment as specified under § 425.400(a)(3), the beneficiary's name appears on the prospective assignment list provided to the ACO at the beginning of the performance year.

(2) The beneficiary has been notified in compliance with § 425.708 that the ACO has requested access to beneficiary identifiable claims data in order to improve the quality of care that is furnished to the beneficiary and, where applicable, coordinate care offered to the beneficiary; and

(3) The beneficiary did not exercise the opportunity to decline having his/her claims data shared with the ACO as provided in § 425.708.

(e) At the ACO's request, CMS continues to provide ACOs with updates to the requested beneficiary identifiable claims data, subject to beneficiary's opportunity to decline data sharing under § 425.708.

(f) If an ACO requests beneficiary identifiable information, compliance with the terms of the data use agreement described in § 425.710 is a condition of an ACO's participation in the Shared Savings Program.

[76 FR 67973, Nov. 2, 2011, as amended at 80 FR 32844, June 9, 2015; 83 FR 68082, Dec. 31, 2018; 87 FR 70249, Nov. 18, 2022]

(a) ACOs must limit their identifiable data requests to the minimum necessary to accomplish a permitted use of the data. The minimum necessary Parts A and B data elements may include but are not limited to the following data elements:

(1) Beneficiary ID.

(2) Procedure code.

(3) Gender.

(4) Diagnosis code.

(5) Claim ID.

(6) The from and through dates of service.

(7) The provider or supplier ID.

(8) The claim payment type.

(9) Date of birth and death, if applicable.

(10) TIN.

(11) NPI.

(b) The minimum necessary Part D data elements may include but are not limited to the following data elements:

(1) Beneficiary ID.

(2) Prescriber ID.

(3) Drug service date.

(4) Drug product service ID.

(5) Quantity dispensed.

(6) Days supplied.

(7) Brand name.

(8) Generic name.

(9) Drug strength.

(10) TIN.

(11) NPI.

(12) Indication if on formulary.

(13) Gross drug cost.

(a) Beneficiaries must receive notification about the Shared Savings Program and the opportunity to decline claims data sharing and instructions on how to inform CMS directly of their preference.

(1) FFS beneficiaries are notified about the opportunity to decline claims data sharing through CMS materials such as the Medicare & You Handbook and through the notifications required under § 425.312.

(2) The notifications provided under § 425.312 must state that the ACO may have requested beneficiary identifiable claims data about the beneficiary for purposes of its care coordination and quality improvement work, and inform the beneficiary how to decline having his or her claims information shared with the ACO in the form and manner specified by CMS.

(3) Beneficiary requests to decline claims data sharing will remain in effect unless and until a beneficiary subsequently contacts CMS to amend that request to permit claims data sharing with ACOs.

(b) The opportunity to decline having claims data shared with an ACO under paragraph (a) of this section does not apply to the information that CMS provides to ACOs under § 425.702(c).

(c) In accordance with 42 U.S.C. 290dd-2 and the implementing regulations at 42 CFR part 2, CMS does not share beneficiary identifiable claims data relating to the diagnosis and treatment of alcohol and substance abuse without the explicit written consent of the beneficiary.

(d) The provisions of this section relate only to the sharing of Medicare claims data between the Medicare program and the ACO under the Shared Savings Program and are in no way intended to impede existing or future data sharing under other authorities.

[76 FR 67973, Nov. 2, 2011, as amended at 80 FR 32840, June 9, 2015]

(a)(1) Before receiving any beneficiary identifiable data, ACOs must enter into a DUA with CMS. Under the DUA, the ACO must comply with the limitations on use and disclosure that are imposed by HIPAA, the applicable DUA, and the statutory and regulatory requirements of the Shared Savings Program.

(2) If the ACO misuses or discloses data in a manner that violates any applicable statutory or regulatory requirements or that is otherwise non-compliant with the provisions of the DUA, it will no longer be eligible to receive data under subpart H of this part, may be terminated from the Shared Savings Program under § 425.218, and may be subject to additional sanctions and penalties available under the law.

(b) [Reserved]