Summary of Engrossed Substitute Bill: OFM must initiate a competitive procurement process to select a lead organization and a data vendor. The proposal must include criteria to be applied in the scoring evaluation that include the following: extra points must be awarded based on the degree of experience in health care data collection, analysis, analytics, and security; extra points must be awarded for experience setting up an all-payer claims database in at least two other states; and extra points must be awarded for a long-term self-sustainable financial model. The successful lead organization must be certified as a qualified entity by the Centers for Medicare and Medicaid Services by December 31, 2017.

OFM must hold a separate contract with a data vendor that works at the direction of the lead organization to perform data collection, processing, aggregation, extracts, and analytics. Duties for the data vendor include the following: establish a secure data submission process, review data files, ensure quality of data files, assign unique identifiers to individuals represented in the database, demonstrate internal controls and state of the art encryption methods, store data on a secure server, and ensure state of the art security for transferring data.

The following data suppliers must provide claims data: the Medicaid program, the Public Employees Benefits Board program, all health insurance carriers operating in this state, all third-party administrators paying claims on behalf of health plans in this state, and the state Labor and Industries program. The Director of OFM may expand this requirement to include other types of insurance policies, such as Long-Term Care policies and Medicare supplemental coverage. Employer-sponsored self-funded health plans and Taft-Hartley trusts may voluntarily provide claims data.

The lead organization must develop a plan for the financial sustainability of the database as self-sustaining. The $5,000 cap on the fees the lead organization may charge is removed. Any fees must be approved by OFM and should be comparable, accounting for relevant differences across data requests and uses. Fees must not be applied to providers or data suppliers other than the fees directly related to requested reports.

The advisory committees the lead organization must convene are modified to include in-state representation from key provider organizations, hospitals, public health, health maintenance organizations, large and small private purchasers, consumer organizations, and the two largest carriers supplying claims data.

Requests for claims data must include the following: the identity of any entities that will analyze the data; stated purpose of the request; a description of the proposed methodology; the specific variable requested; how the requester will ensure all data is handled to ensure privacy and confidentiality protection; the method for storing, destroying, or returning the data to the lead organization; and protections that will ensure the data is not used for any purposes not authorized by the approved application. Any entity that receives claims or other data must maintain confidentiality and may only release data if it does not contain proprietary financial information or direct or indirect patient identifiers, and the release is described and approved as part of the request.

The lead organization, in conjunction with OFM and the data vendor, must create a process to govern levels of access to the data:

Claims data that include proprietary financial information, direct patient identifiers, and indirect patient may be released only to researchers with a signed data use and confidentiality agreement. Access for federal, state and local government agencies is removed, and access for the lead organization is removed;
Claims data that do not contain proprietary financial information or direct patient identifiers may be released to agencies, researchers, and other entities with a signed data use agreement; and
Claims data that do not contain proprietary financial information, direct patient identifiers, or indirect patient identifiers may be released upon request.

Reports may not contain proprietary financial information, or direct or indirect patient identifiers; however, aggregate zip codes, gender, and age may be used to generate reports so long as they cannot lead to the identification of an individual. Reports issued by the lead organization in conjunction with the data vendor may utilize proprietary financial information to calculate aggregate cost data. OFM must develop in rule a format for the calculation and display of aggregate cost data. OFM must solicit feedback from stakeholders and must consider data presented as proportions, ranges, averages, and medians, as well as the differences in types of data.

Recipients of data must protect data containing direct and indirect identifiers, proprietary financial information, or any combination thereof; must not re-disclose the data; nor attempt to determine the identify of any person whose information is included in the data set. The data must be destroyed or returned at the conclusion of the data use agreement.

By October 31 of each year, the lead organization must submit a list to OFM of reports they anticipate producing during the following calendar year. OFM may establish a public comment period not to exceed 30 days and must submit the list and any comments to the appropriate committees of the Legislature for review. The lead organization may not publish any report that directly or indirectly identifies individual patients; disclose a carrier's proprietary financial information, or compare performance that includes any provider with fewer than four providers, rather than five. The lead organization may not release a report that compares providers, hospitals, or data suppliers unless it allows verification of the data and comment on the reasonableness of conclusions reached. The requirement to limit reports where one data supplier comprises more than 25 percent of the claims data is removed. The lead organization must distinguish in advance when it is operating as the lead organization and when it is operating in its capacity as a private entity. The claims data that contain direct patient identifiers or proprietary financial information must remain exclusively in the custody of the data vendor and may not be accessed by the lead organization.

By December 1, 2016 and 2017, OFM must report to the Legislature on the development of the database including, but not limited to, budget and cost detail, technical progress, and work plan metrics. Two years after the first report is issued, OFM must report to the Legislature every two years regarding the cost, performance, and effectiveness of the database, and the performance of the lead organization. Using independent economic expertise, subject to appropriation, the report must evaluate whether the database advanced the goals established for the database, as well as the performance of the lead organization. The report must make recommendations on how the database can be improved, whether the contract for the lead organization should be modified, renewed, or terminated, and the impact the database had on competition between and among providers, purchasers, and payers.

The act contains a severability clause in the event any portion of the act is determined to be invalid.