129 CMR, § 3.03

Current through Register 1538, January 3, 2025

Section 3.03 - Data Release Review Board and Review Procedures

(1)Public Use Files. The Council shall create three public use files of the Health Care Claims Data, including the Member Eligibility (ME) data, Medical Claims (MC) data, and Pharmacy Claims (PC) data.

(a)Level 1. The Level 1 file includes the following Data Elements:

Data Element #	Data Element Name
ME003	Insurance Type
ME004	Year of Reported Eligibility
ME005	Month of Reported Eligibility
ME007	Coverage Level Code
ME012	Individual Relationship Code
ME013	Member Gender
ME016	Member State or Province
ME018	Medical Coverage -Yes/No
ME019	Prescription Drug Coverage -Yes/No
ME020	Race 1
ME021	Race 2
ME022	Other Race
ME023	Hispanic Indicator -Yes/No
ME024	Ethnicity 1
ME025	Ethnicity 2
ME026	Other Ethnicity
MC003	Insurance Type/Product Code
MC011	Individual Relationship Code
MC012	Member Gender
MC019	Admission Hour
MC020	Admission Type
MC021	Admission Source
MC022	Discharge Hour
MC023	Discharge Status Length of Stay (LOS)
MC027	Service Provider Entity Type Qualifier
MC031	Service Provider Suffix
MC034	Service Provider State
MC035A	Service Provider Country Name
MC036	Type of Bill -on Facility Claims
MC037	Site of Service -on NSF/CMS 1500 Claims
MC038	Claim Status
MC039	Admitting Diagnosis
MC040	E-Code
MC041	Principal Diagnosis
MC042	Other Diagnosis -1
MC043	Other Diagnosis -2
MC044	Other Diagnosis -3
MC045	Other Diagnosis -4
MC046	Other Diagnosis -5
MC047	Other Diagnosis -6
MC048	Other Diagnosis -7
MC049	Other Diagnosis -8
MC050	Other Diagnosis -9
MC051	Other Diagnosis -10
MC052	Other Diagnosis -11
MC053	Other Diagnosis -12
MC054	Revenue Code
MC055	Procedure 1 Code
MC056	Procedure 1 Modifier- 1
MC057	Procedure 1 Modifier -2
MC058	ICD-9-CM Procedure 1 Code
MC061	Quantity
MC065	Copay Amount
MC067	Deductible Amount
PC003	Insurance Type/Product Code
PC011	Individual Relationship Code
PC012	Member Gender
PC017	Date Service Approved (AP Date)
PC024A	Pharmacy Country Name
PC025	Claim Status
PC026	Drug Code
PC027	Drug Name
PC028	New Prescription
PC028A	Refill Number
PC029	Generic Drug Indicator
PC030	Dispense as Written Code
PC031	Compound Drug Indicator
PC033	Quantity Dispensed
PC034	Days Supply
PC037	Average Wholesale Price (AWP)
PC038	Postage Amount Claimed
PC039	Dispensing Fee
PC040	Copay Amount
PC042	Deductible Amount

(b)Level 2. The Level 2 file includes all the data elements in Level 1 plus the following data elements:

Data Element #	Data Element Name
ME001	Payer
ME002	National Plan ID
ME008	Encrypted Subscriber Unique Identification Number
ME009	Plan Specific Contract Number
ME010	Member Suffice or Sequence Number
ME011	Member Identification Code
Member Age in Years
Member Age in Months
ME015	Member City Name
ME017	Member ZIP Code
MC001	Payer
MC002	National Plan ID
MC004	Payer Claim Control Number
MC005	Line Counter
MC005A	Version Number
MC007	Encrypted Subscriber Unique Identification Number
MC008	Plan Specific Contract Number
MC009	Member Suffix or Sequence Number
MC010	Member Identification Code
MC014	Member City Name
MC015	Member State or Province
MC016	Member ZIP Code
MC017	Date Service Approved (AP Date)
MC018	Admission Date
MC022A	Discharge Date
Member Age in Years at Discharge
Member Age in Months at Discharge
MC024	Service Provider Number
MC025	Service Provider Tax ID Number
MC026	National Service Provider ID
MC028	Service Provider First Name
MC029	Service Provider Middle Name
MC030	Service Provider Last Name or Organization Name
MC032	Service Provider Specialty
MC033	Service Provider City Name
MC035	Service Provider ZIP Code
MC059	Date of Service -From
MC060	Date of Service -Thru
MC062	Charge Amount
MC063	Paid Amount
MC064	Prepaid Amount
MC066	Coinsurance Amount

(c) Level 3. The Level 3 file includes all the data elements in Level 2 plus the following data elements:

Data Element #	Data Element Name
ME006	Insured Group or Policy Number
ME014	Member Date of Birth
MC006	Insured Group or Policy Number
MC013	Member Date of Birth
PC006	Insured Group Number
PC013	Member Date of Birth

(2)Data Release Review Board. The Council shall designate a Data Release Review Board to review applications for Health Care Claims Data filed pursuant to M.G.L. c. 6A, § 16K.

(a)Members. The Board shall include at least one member of the Councilor Council member's designee; one member of the Council's Advisory Committee (established pursuant to M.G.L. c. 6A, § 16L); an attorney with expertise in health data privacy issues; a data security expert; a representative of a hospital licensed in Massachusetts; a clinician licensed to practice in Massachusetts; and any other individual whom both the Councilor designated Council staff deem necessary for the review and evaluation of applications for Health Care Claims Data. The Board shall include at least one person who has expertise using statistics, clinical data, demographic data, and payment data.

(b)Terms. Members of the Board shall be appointed to serve for two years, but may be removed by a vote of the majority of the Council.

(c)Administration. Under the Board's direction and authority, Council staff shall:

1. develop standard application materials;

2. review all applications for Health Care Claims Data;

3. ensure that all applications for Health Care Claims Data are complete;

4. process and approve applications for Level 1 Data Elements that meet the requirements of 129 CMR 3.03 through 3.05 and that do not involve any Level 2 data elements;

5. refer to the Board for review all applications for Level 2 Data Elements and any other applications that the Administrative Director or Council staff deem appropriate for the Board's review;

6. reject all applications for Level 3 Data, except those applications received from state agencies pursuant to 129 CMR 3.03(4);

7. refer all applications for Level 3 Data received from state agencies to the Board for review and action by the Board; and

8. prepare materials for presentation to the Board.

(d)Meetings. The Board shall meet regularly according to a schedule set by the Council to review applications for Level 2 and Level 3 Data Elements and to review applications for any other Health Care Claims Data that Council staff deems appropriate for the Board's review.

(e)Criteria for Release of Data. The Board will review the proposed use of the data, the credentials of the applicant, and the nature of the data requested. The Board shall, at a minimum, consider the following factors:

1. whether the proposed use of the data will jeopardize patient privacy;

2. whether the proposed disclosure may enable collusion or anti-competitive conduct;

3. the effect of the proposed use on the quality and costs of health care; and

4. whether the proposed use will further the public interest by promoting improvements in health care quality or reductions in the growth of health care costs.

(3)Application Review Procedures.

(a)Applications for Data. All data applicants requesting access to, disclosure of, or use of Health Care Claims Data shall submit a written application using a form approved by the Council. In accordance with 129 CMR 3.03(3), only state agencies may apply for Level 3 Data.

(b)Application Requirements. All applicants shall:

1. specify the purpose and intended use of the data requested, including a detailed project description;

2. specify each data field requested;

3. justify the need for each requested Level 2 Data Element to accomplish the applicant's stated purpose;

4. specify the applicant's qualifications to perform such research or accomplish the intended use;

5. specify administrative, security and privacy measures to be taken to safeguard the confidentiality of patient information, payment rates, and any Level 2 and Level 3 Data Elements that the Board permits to be released, and to prevent unauthorized access to or use of such data;

6. specify the applicant's methodology for maintaining data integrity and accuracy;

7. identify all employees who will have access to the requested Health Care Claims Data, and describe the activities they will conduct with the data and their qualifications to conduct those activities;

8. specify whether the applicant intends to engage an agent or contractor to conduct any function with the requested data and if so, identify such functions, describe the agent's or contractor's qualifications, state whether the agent or contractor will have access to the data at a location other than the applicant's location or in an off-site server and/or database, and specify all data security measures to be instituted with such agent or contractor;

9. specify measures the applicant, his/her employees, and his/her agents will take to return the original released data to the Council at the conclusion of the applicant's use and to destroy all copies of the data remaining in the applicant's, his/her employee's and his/her agent's possession or control;

10. specify research protocols, as applicable;

11. specify whether the data will be linked to or used in conjunction with other data sources and if so, identify such data sources and explain the purpose for such linking and whether such linking would enable re-identification of the requested data elements;

12. specify the applicant's plans to publish or otherwise disclose any Level 1, Level 2 and Level 3 Data Elements, or any data derived or extracted from such data, in any paper, report, website, statistical tabulation, or similar document; and

13. agree to pay the application fee or request a waiver of the fee.

(c)Criteria for Approval. The Board may approve for release to an applicant only the requested Health Care Claims Data that the Board determines is necessary to accomplish the applicant's purpose and intended use. Factors the Board may consider in determining whether to exercise its discretion to approve an application for Health Care Claims Data include, but are not limited to, the following:

1. the purpose for which the data is requested is in the public interest and is consistent with the mission and goals of the Council. Uses that serve the Council's mission and the public interest include, but are not limited to: health cost, quality and utilization analyses to formulate public policy; financial studies and analysis of hospital payment systems; utilization review studies; studies to develop indicators of quality of care and to identify areas for improvement; health care facility merger analyses; health planning and resource allocation studies; epidemiological studies, including the identification of morbidity and mortality patterns, and studies of prevalence and incidence of diseases; and research studies and investigation of other health care issues;

2. the applicant has demonstrated it is qualified to undertake the study or accomplish the intended use;

3. the applicant requires such data in order to undertake the study or accomplish the intended use;

4. the applicant can ensure that patient privacy will be protected;

5. the applicant can ensure that the identities of clinicians will be kept confidential;

6. the applicant can ensure that individual payment rates will be kept confidential;

7. the applicant can safeguard against unauthorized use and disclosure;

8. the applicant signs a Data Use Agreement that sets forth its agreement to comply with data release restrictions, prohibitions, and protections for the Council's Data; and

9. the applicant requires that any staff or agent that will have access to or process the data on the applicant's behalf agrees to follow all data restrictions, prohibitions, and protections set forth in 129 CMR 3.00 and the Data Use Agreement.

(4)Data Release Procedures.

(a) The Council shall establish a regular schedule for submission of applications and for review by the Board. The schedule shall provide that the Board will make reasonable efforts to notify each applicant of the Board's decision within 45 days of the scheduled application submission date.

(b) The Board shall authorize access to data containing the fewest number of Data Elements necessary to accomplish the applicant's purpose or intended use. Similarly, if the Board determines that not all of the elements the applicant has requested are consistent with the applicant's intended use and purpose or with the mission and goals of the Council, or that release of certain requested elements may jeopardize patient privacy , or may enable collusion or anti-competitive conduct or may involve a likelihood of increasing health care costs, the Board may authorize the release of only those Data Elements that the Board deems consistent with the applicant's purpose and intended use or the Council's mission and goals or the release of which will not jeopardize patient privacy, enable collusion or anti-competitive conduct, or involve a likelihood of increasing health care costs.

(c) If the application is incomplete or if the Board determines that supplemental information is needed to make its decision, the Board may require such supplemental information and notify the applicant accordingly. The Board's request for supplemental information from the applicant will trigger a new 45-day notification period (as set forth 129 CMR 3.03(2)(a)): a new 45-day notification period will begin to run on the date the applicant must provide the supplemental information to the Board (the date to be determined by the Board) or the date the applicant in fact provides the supplemental information to the Board, whichever is later.

(d) If the Board denies an application for data in whole or in part, the Board will notify the applicant of the reason for denial.

(e) An applicant may resubmit his or her application to address the concerns raised by the Board in its decision. The Board may reconsider a determination made under 129 CMR 3.03 based on new information or any other reasonable cause.

(f) An applicant may appeal the denial of any application for data release by the Board to the Council. Such appeal must be filed within 30 days of the Board's decision and must specify the reason(s) that the applicant considers the Board's decision to be in error.

(4)Data Release to State Agencies. The Council may release to state agencies Level 1 and Level 2 data for uses that promote the public interest; and Level 3 data as authorized by M.G.L. c. 6A, § 16K.

(a) Except as provided in 129 CMR 3.03(4)(e), a state agency must submit an application to the Data Release Review Board for data in compliance with the requirements of 129 CMR 3.02(b).

(b) Each agency shall enter into an interagency service agreement with the Council that allows for specifically approved purposes and uses within the public interest, provides for security and measures to safeguard the confidentiality of patient information, fulfills the applicable requirements set forth in 129 CMR 3.03(2)(b) and (c), and makes the required assurances set forth in 129 CMR 3.04(1).

(d) After an agency's initial request has been approved by the Board and an interagency service agreement has been executed, the Council may expedite subsequent data requests through a streamlined review process for additional agency projects or uses not stated in the original request.

(e) The Council will provide state agencies with public use files free of charge. The Council may charge a state agency that requests custom programming of the Council's datasets the actual cost incurred to fulfill the request. The Council will notify the agency of the estimated cost prior to fulfilling the request.

(f)Level 3 Data.

1. The Council may release Level 3 data to state agencies for purposes that promote the public interest as determined by the Council.

2. The Council shall provide the Division of Health Care Finance and Policy with the Level 3 Health Care Claims Data in accordance with the provisions of M.G.L. c. 6A, § 16K under an interagency service agreement for the purpose of conducting data analysis, preparing reports to assist in the formulation of health care policy and the provisions and purchase of health care services, and reviewing and evaluating mandated benefit proposals as required by M.G.L. c. 3, § 38C.

129 CMR, § 3.03