(Story updated at 4:00 p.m. ET)
Data mining of patient medical records kept by the federal government will get a boost by the CMS, following the release of finalized changes to the so-called Qualified Entity Program.
The final rule released Friday authorizes certain CMS-approved organizations – including for-profit companies – to buy Medicare claims and other federal data at a price that matches the governments' cost in processing the data. These “qualified entities” can then combine it with patient data from insurance companies, providers and other sources, and then resell that data to those organizations and others, including employers and devicemakers.
“Increasing access to analyses and data that include Medicare data will make it easier for stakeholders throughout the healthcare system to make smarter and more informed healthcare decisions,” said CMS Chief Data Officer Niall Brennan. The agency says the program is a part of a broader effort by the Obama administration to help providers boost quality and improve cost-efficiency.
The QEP program was created under the Affordable Care Act. So far, 15 organizations have signed and were approved by the CMS as “qualified entities” to receive patient-identifiable claims records from Medicare, Medicaid and the Children's Health Insurance Program, according to a CMS webpage about the program.
The final rule doesn't differ substantially from the proposed rule, though it did modify the definition of an “authorized user” to clarify that the data can be used by contractors or business associates of the authorized users that are buying or being given the data. It also included government entities as possible end-users.
Pam Dixon, executive director of the San Diego-based World Privacy Forum, is concerned about the rule's potential to allow third parties to use data for sales or marketing purposes, rather than healthcare quality improvement. She's particularly worried that allowing additional third parties – including contractors – to receive the data and use it for non-healthcare purposes.
“Our research has found that health data is a very compelling data set for most data aggregators and data resellers,” Dixon said. “Until this time it's been really hard to get high-accuracy health data.”
In its press release, the CMS said “if entities receive patient identifiable data or analyses, they must use protections that are at least as stringent as what is required of covered entities and their business associates for protected health information under the (federal) privacy and security rules.”
The CMS dataset is one of the largest in the U.S. and perhaps one of the largest in the world, Dixon said. Allowing it to be held by more organizations increases the likelihood of access to hackers that could sell the data on the black market.
The final rule also clarifies that a qualified entity can't provide or sell a non-public analysis to an insurer for an area in which they don't provide coverage, in line with a Medicare Access and CHIP Reauthorization Act requirement that prevents qualified entities from providing or selling analyses to issuers that haven't provided the qualified entity with data. If they don't have covered lives in the data area, they won't be able to contribute to the analyses, the CMS said.
This change prevents insurers from using the data for strategic purposes other than quality improvement, such as to explore expanding a health plan to additional geographic areas, Dixon said. “Without that clarification, regional insurers that only cover one state or section of the country could all of the sudden extend their analysis with a personally-identifiable dataset across the nation,” she said.
Most of the qualified entities are regional or state-wide quality improvement organizations and only will be gathering data for patients within their geographical areas, according to the CMS.
But four of the 15 have nationwide reach. They include two for-profit companies, Amino, a startup based in San Francisco and funded by venture capital and OptumLabs, a collaborative led by Optum, the health information technology, data mining and analytics arm of health insurance giant UnitedHealth Group based in Minnetonka, Minn.
Also serving the entire nation is the Health Care Cost Institute, a not-for-profit that is funded in part by for-profit insurers UnitedHealth Group and Aetna, as well as not-for-profit giant Kaiser Permanente. The other national organization is FairHealth, a not-for-profit insurance claims data miner established as the result of government legal action taken against Optum's data mining predecessor, then called Ingenix, and other major insurance carriers.
In the 2009 settlement, the insurers did not admit wrongdoing, but they paid to set up FairHealth as a replacement for Ingenix. New York Governor Andrew Cuomo, then the state's Attorney General, said Ingenix had consistently understated providers' geographically based “usual and customary” charges. The local rates were used by many insurance companies to calculate payments when a patient used an out-of-network physician.
“I'm concerned about for-profit companies becoming new kind of data aggregator for CMS data,” Dixon said. “It could become a new business model, and I think this clearly opens the door to that, depending on how many for-profit entities CMS approves.”
