Background:

Engrossed Second Substitute House Bill 2572, enacted in the 2014 legislative session, required the Office of Financial Management (Office) to establish a statewide all-payer health care claims database. The goals of the database are to improve transparency to: assist patients, providers, and hospitals to make informed choices about care; enable providers, hospitals, and communities to benchmark their performance; enable purchasers to identify value, build expectations into their purchasing strategies, and reward improvements over time; and promote competition based on quality and cost.

Lead Organization.

The Director of the Office (Director) is required to select a lead organization to coordinate and manage the database, and the lead organization is responsible for collecting claims data and reporting performance on cost and quality. At the direction of the Office, the lead organization must, among other things: design collection mechanisms with consideration for time, cost, and benefits; ensure protection of collected data; make information from the database available as a resource; develop policies to ensure quality of data releases; develop a plan for financial sustainability and charge fees up to $5,000 (unless otherwise negotiated), with any fees comparable across requests and users and approved by the Office; and appoint advisory committees on data policy and the data release process.

The Office initiated rulemaking in July 2014, but delayed selection of a lead organization.

Submissions to the Database.

Data suppliers must submit claims data to the database within the time frames established by the Director and in accordance with procedures established by the lead organization. "Claims data" include: (1) claims data related to health care coverage and services funded in the operating budget for Medicaid programs and the Public Employees Benefits Board program; and (2) claims data voluntarily provided by other data suppliers, including carriers and self-funded employers. An entity that is not a data supplier but that chooses to participate in the database must require any third-party administrator to release any claims data related to persons receiving health coverage from the entity's plan. Data suppliers must submit an annual status report to the Office regarding their compliance.

Confidentiality and Release of Claims Data.

The Office must direct the lead organization to maintain the confidentiality of the data it collects that include direct or indirect patient identifiers. Any person who receives data with patient identifiers must also maintain confidentiality and may not release the information. Data with direct or indirect patient identifiers, as specifically defined in rule, may be released to: (1) federal, state, and local government agencies upon receipt of a signed data use agreement; and (2) researchers with approval of an institutional review board upon receipt of a signed confidentiality agreement. Data with indirect patient identifiers may be released to an agency, researcher, and other person upon receipt of a signed data use agreement. Data that do not contain direct or indirect patient identifiers may be released upon request. "Direct patient identifier" means information that identifies a patient, and "indirect patient identifier" means information that may identify a patient when combined with other information.

Recipients of data with patient identifiers must agree in a data use agreement and confidentiality agreement to take steps to protect patient identifying information and not re-disclose the data except as authorized in the agreement or as otherwise required by law. Recipients of data may not attempt to determine patients' identity or use the data in a manner that identifies the individuals or their families.

Data obtained through activities related to the database are not subject to subpoena, and a person with access to the data may not be compelled to testify.

Reports by the Lead Organization.

Under the supervision of the Office, the lead organization must use statewide performance measures and the database to prepare health care data reports. Prior to releasing reports that use claims data, the lead organization must submit the reports to the Office for review and approval. Comparisons of costs among systems must account for differences, including acuity of patients.

The lead organization may not publish data or reports that directly or indirectly identify patients or disclose specific reimbursement arrangements between a provider and a payer. In addition, the lead organization may not compare performance in a report generated for the general public that includes any provider in a practice with fewer than five providers. The lead organization may not release a report comparing or identifying providers, hospitals, or data suppliers unless it allows them to verify the accuracy of the information and submit corrections within 45 days and unless it corrects errors. The lead organization must ensure that no individual carrier or self-insured employer using the carrier's provider contracts comprises more than 25 percent of the claims data used in any report or other analysis generated from the database.

Summary of Bill:

Lead Organization.

Starting no later than July 1, 2015, the Director of the Office of Financial Management (Office) must use a competitive process to select a lead organization to coordinate and manage the all-payer health care claims database. The organization must be composed of health care purchasers, state licensed insurers, union trusts, providers, and consumers. The Office must use a competitive procurement process, including a request for information prior to issuing a request for proposal. All documents must be posted on the Office website.

The requirements for the lead organization are modified. It must:

design data collection mechanisms considering the time and cost incurred by data suppliers and others in submission;
store data with proprietary financial information in compliance with the bill;
develop protocols and policies, including pre-release peer review by data suppliers, to ensure the quality of data releases and reports;
charge fees that are comparable, accounting for relevant differences across requests and uses; and
ensure that advisory committees include in-state representation from stakeholders, including large and small private purchasers and the two largest carriers supplying claims data.

The $5,000 cap on the lead organization's fees is eliminated. The Office must adopt procedures for establishing appropriate fees.

Submissions to the Database.

The state Medicaid program, Public Employees' Benefits Board programs, and all health carriers operating in the state must submit their claims data to the database. The Director may expand this requirement to include other types of insurance policies, such as long-term care insurance policies. Employer-sponsored self-funded plans and Taft-Hartley trusts may voluntarily provide claims data. Any data suppliers used by an entity that voluntarily participates in the database must provide claims data to the lead organization upon the entity's request. The lead organization (instead of each data supplier) must submit an annual status report to the Office regarding compliance with these requirements.

"Claims data" means the data required to be submitted, including billed, allowed, and paid amounts, and additional information defined in rule. "Data supplier" means a carrier that provides claims data and a carrier, third-party administrator, or other entity that provides data at the request of an employer-sponsored self-funded plan or Taft-Hartley trust.

Release of Claims Data.

Requests for claims data must include the following information:

the identity of the entities that will analyze the data;
the purpose of the request and an explanation of how it supports the goals of the law governing the database;
the proposed methodology;
the specific variables requested and an explanation of how the data are necessary to achieve the stated purpose;
how the requester will ensure the data are handled in accordance with required privacy and confidentiality protections;
the method by which the data will be stored, destroyed, or returned to the lead organization; and
the protections that will be used to keep the data from being used for unauthorized purposes.

The lead organization may deny a request for data if the request does not include the required information or meet criteria established by the lead organization's advisory committee or for reasons established by rule.

In conjunction with the Office, the lead organization must develop a process to govern levels of access to and use of data. Data that include proprietary financial information or direct patient identifiers may be released only to the extent necessary to achieve the goals of the all-payer health care claims database:

government agencies on receipt of a signed data use and confidentiality agreement. Government agencies may not use the data in the purchase or procurement of health benefits for their employees;
researchers with approval of an institutional review board on receipt of a signed data use and confidentiality agreement. A researcher or research organization must agree not to disclose the data to any other party, including affiliated entities; and
any entity when functioning as the lead entity.

Data that contain indirect patient identifiers but do not contain proprietary financial information or direct patient identifiers may be released to entities approved by the lead organization. Data that do not contain direct or indirect patient identifiers or proprietary financial information may be released upon request.

The lead organization must distinguish in advance to the Office when it is operating as the lead organization versus when it is operating as a private entity. When acting as a private entity, its access to data is governed by the same process as other requesters.

Confidentiality.

The Office must direct the lead organization to maintain the confidentiality of data that include proprietary financial information, in addition to direct or indirect patient identifiers. Any entity that receives data must also maintain confidentiality and may only release the data if: (1) it does not contain proprietary financial information or direct or indirect patient identifiers; and (2) the release is approved as part of the data request. A "direct patient identifier" is a data variable that directly identifies an individual, and an "indirect patient identifier" is a data variable that may identify an individual when combined with other information. "Proprietary financial information" means claims data or reports that disclose or would allow the determination of specific terms of contracts, discounts, or fixed reimbursement arrangements or other specific reimbursement arrangements between a facility or provider and a payer, or internal fee schedule or other internal pricing mechanism of integrated delivery systems owned by a carrier.

Recipients of data must agree in a data use or confidentiality agreement to:

take steps to protect data containing direct or indirect patient identifiers or proprietary financial information;
not redisclose the claims data, unless it does not contain proprietary financial information or direct or indirect patient identifiers and the release is approved as part of the data request;
not attempt to determine the identity of a person whose data is included in the data set or use the claims or other data in a manner that identifies an individual or family; and
store, destroy, or return claims data at the conclusion of the agreement.

Reports using data obtained through this process may not contain proprietary financial information or direct or indirect patient identifiers. Reports issued by the lead organization may use proprietary financial information to calculate aggregate cost data to be displayed in the report. The Office must approve a format for calculating and displaying aggregate cost data to prevent the disclosure or determination of proprietary financial information. In developing the format, the Office must solicit feedback from stakeholders and consider data presented as proportions, ranges, averages, and medians, as well as the differences in types of data gathered and submitted.

Data that are distributed or reported through activities related to the database (in addition to data that are obtained through such activities) are not subject to subpoena, and a person with access to the data may not be compelled to provide such information pursuant to subpoena.

Reports by the Lead Organization.

Through the contract with the Office (in addition to being under the Office's supervision), the lead organization must prepare reports using the database and the statewide performance and quality measure set. Prior to release, the lead organization must submit reports to the Office for review (but not approval). By October 31 of each year, the lead organization must submit to the Office a list of reports it anticipates producing during the following year. The Director may establish a public comment period and must submit the list and any comments to the Legislature for review.

Reports that use claims data prepared by the lead organization for the Legislature and the public should promote awareness and transparency in the health care market. The features of such reports are modified to include comparisons of costs among providers and systems that account for differences in the case mix and severity of illness of patients and populations.

The lead organization's published data and reports may not: (1) disclose a carrier's proprietary financial information; or (2) compare performance in a report for the general public that includes any provider in a practice with fewer than four providers (rather than five). The lead organization may not release a report comparing and identifying providers, hospitals, or data suppliers unless it allows the provider, hospital, or data supplier to comment on the reasonableness of conclusions reached and submit corrections within 30 days (rather than 45 days).

The requirement that no individual data supplier comprise more than 25 percent of the data used in any report is eliminated.

Reports to the Legislature.

By December 1 of 2016 and 2017, the Office must report to the Legislature regarding the development and implementation of the database, including budget and cost detail, technical progress, and work plan metrics. Following the year in which the first report is issued or the first release is provided from the database, the Office must report to the Legislature every two years on the cost, performance, and effectiveness of the database and the performance of the lead organization. The report must use independent economic expertise, subject to appropriation, to evaluate the lead organization's performance and whether the database has advanced its stated goals. The report must also make recommendations on: (1) how the database could be improved; (2) whether the contract with the lead organization should be modified, renewed, or terminated; and (3) the impact the database has had on competition.