(a) Definition of risk adjustment data. Risk adjustment data are all data that are used in the development and application of a risk adjustment payment model.

(b) Data collection: Basic rule. Each MA organization must submit to CMS (in accordance with CMS instructions) the data necessary to characterize the context and purposes of each item and service provided to a Medicare enrollee by a provider, supplier, physician, or other practitioner. CMS may also collect data necessary to characterize the functional limitations of enrollees of each MA organization.

(c) Sources and extent of data.

(1) To the extent required by CMS, risk adjustment data must account for the following:

(i) Items and services covered under the original Medicare program.

(ii) Medicare covered items and services for which Medicare is not the primary payer.

(iii) Other additional or supplemental benefits that the MA organization may provide.

(2) The data must account separately for each provider, supplier, physician, or other practitioner that would be permitted to bill separately under the original Medicare program, even if they participate jointly in the same service.

(d) Other data requirements.

(1) MA organizations must submit data that conform to CMS' requirements for data equivalent to Medicare fee-for-service data, when appropriate, and to all relevant national standards. CMS may specify abbreviated formats for data submission required of MA organizations.

(2) The data must be submitted electronically to the appropriate CMS contractor.

(3) MA organizations must obtain the risk adjustment data required by CMS from the provider, supplier, physician, or other practitioner that furnished the item or service.

(4) MA organizations may include in their contracts with providers, suppliers, physicians, and other practitioners, provisions that require submission of complete and accurate risk adjustment data as required by CMS. These provisions may include financial penalties for failure to submit complete data.

(5) For data described in paragraph (d)(1) of this section as data equivalent to Medicare fee-for-service data, which is also known as MA encounter data, MA organizations must submit a NPI in a billing provider field on each MA encounter data record, per CMS guidance.

(e) Validation of risk adjustment data. MA organizations and their providers and practitioners will be required to submit a sample of medical records for the validation of risk adjustment data, as required by CMS. There may be penalties for submission of false data.

(f) Use and release of data—(1) CMS use of data. CMS may use the data described in paragraphs (a) through (d) of this section for the following purposes:

(i) To determine the risk adjustment factors used to adjust payments, as required under §§422.304(a) and (c);

(ii) To update risk adjustment models;

(iii) To calculate Medicare DSH percentages;

(iv) To conduct quality review and improvement activities;

(v) For Medicare coverage purposes;

(vi) To conduct evaluations and other analysis to support the Medicare program (including demonstrations) and to support public health initiatives and other health care-related research;

(vii) For activities to support the administration of the Medicare program;

(viii) For activities conducted to support program integrity; and

(ix) For purposes authorized by other applicable laws.

(2) CMS release of data. Regarding data described in paragraphs (a) through (d) of this section, CMS may release the minimum data it determines is necessary for one or more of the purposes listed in paragraph (f)(1) of this section to other HHS agencies, other Federal executive branch agencies, States, and external entities in accordance with the following:

(i) Applicable Federal laws;

(ii) CMS data sharing procedures;

(iii) Subject to the protection of beneficiary identifier elements and beneficiary confidentiality, including—

(A) A prohibition against public disclosure of beneficiary identifying information;

(B) Release of beneficiary identifying information to other HHS agencies, other Federal executive branch agencies, and States only when such information is needed; and

(C) Release of beneficiary identifying information to external entities only to the extent needed to link datasets.

(iv) Subject to the aggregation of dollar amounts reported for the associated encounter to protect commercially sensitive data.

(v) Risk adjustment data other than data described in paragraphs (f)(2)(iii) and (f)(2)(iv) of this section will be released without the redaction or aggregation described in paragraphs (f)(2)(iii) and (f)(2)(iv) of this section, respectively.

(3) Risk adjustment data will not become available for release under this paragraph (f) unless—

(i) The risk adjustment reconciliation for the applicable payment year has been completed;

(ii) CMS determines that data release is necessary under paragraph (f)(1)(vi) of this section for emergency preparedness purposes before reconciliation; or

(iii) CMS determines that extraordinary circumstances exist to release the data before reconciliation.

(g) Deadlines for submission of risk adjustment data. Risk adjustment factors for each payment year are based on risk adjustment data submitted for items and services furnished during the 12-month period before the payment year that is specified by CMS. As determined by CMS, this 12-month period may include a 6-month data lag that may be changed or eliminated as appropriate. CMS may adjust these deadlines, as appropriate.

(1) The annual deadline for risk adjustment data submission is the first Friday in September for risk adjustment data reflecting items and services furnished during the 12-month period ending the prior June 30, and the first Friday in March for data reflecting services furnished during the 12-month period ending the prior December 31.

(2) After the payment year is completed, CMS recalculates the risk factors for affected individuals to determine if adjustments to payments are necessary.

(i) Prior to calculation of final risk factors for a payment year, CMS allows a reconciliation process to account for risk adjustment data submitted after the March deadline until the final risk adjustment data submission deadline in the year following the payment year.

(ii) After the final risk adjustment data submission deadline, which is a date announced by CMS that is no earlier than January 31 of the year following the payment year, an MA organization can submit data to correct overpayments but cannot submit diagnoses for additional payment.

(3) Submission of corrected risk adjustment data in accordance with overpayments after the final risk adjustment data submission deadline, as described in paragraph (g)(2) of this section, must be made as provided in §422.326.

[73 FR 48757, Aug. 19, 2008, as amended at 79 FR 29956, May 23, 2014; 79 FR 50358, Aug. 22, 2014; 80 FR 7960, Feb. 12, 2015; 83 FR 16733, Apr. 16, 2018]