Subject to providing the beneficiary with the opportunity to decline data sharing as described in this §425.708, and subject to having a valid DUA in place, CMS, upon the ACO's request for the data for purposes of evaluating the performance of its ACO participants or its ACO providers/suppliers, conducting quality assessment and improvement activities, and conducting population-based activities relating to improved health, will provide the ACO with beneficiary identifiable claims data for preliminarily prospectively and prospectively assigned beneficiaries and other beneficiaries who receive primary care services from an ACO participant that submits claims for primary care services used to determine the ACO's assigned population under subpart E of this part during the performance year.

(a) If an ACO wishes to receive beneficiary identifiable claims data, it must sign a DUA and it must submit a formal request for data. ACOs may access requested data as often as once per month.

(b) The ACO must certify that it is requesting claims data about either of the following:

(1) Its own patients, as a HIPAA-covered entity, and the request reflects the minimum data necessary for the ACO to conduct its own health care operations work that falls within the first or second paragraph of the definition of health care operations at 45 CFR 164.501.

(2) The patients of its HIPAA-covered entity ACO participants or its ACO providers/suppliers as the business associate of these HIPAA covered entities, and the request reflects the minimum data necessary for the ACO to conduct health care operations work that falls within the first or second paragraph of the definition of health care operations at 45 CFR 164.501 on behalf of those participants.

(c) The use of identifiers and claims data will be limited to developing processes and engaging in appropriate activities related to coordinating care and improving the quality and efficiency of care that are applied uniformly to all Medicare beneficiaries with primary care services at the ACO, and that these data will not be used to reduce, limit or restrict care for specific beneficiaries.

(d) To ensure that beneficiaries have a meaningful opportunity to decline having their claims data shared with the ACO, the ACO may only request claims data about a beneficiary if—

(1) For an ACO participating under—

(i) Preliminary prospective assignment with retrospective reconciliation as specified under §425.400(a)(2), the beneficiary's name appears on the preliminary prospective assignment list provided to the ACO at the beginning of the performance year, during each quarter (and in conjunction with the annual reconciliation) or the beneficiary has received a primary care service from an ACO participant upon whom assignment is based (under subpart E of this part) during the most recent 12-month period; or

(ii) Prospective assignment as specified under §425.400(a)(3), the beneficiary's name appears on the prospective assignment list provided to the ACO at the beginning of the performance year.

(2) The beneficiary has been notified in compliance with §425.708 that the ACO has requested access to beneficiary identifiable claims data in order to improve the quality of care that is furnished to the beneficiary and, where applicable, coordinate care offered to the beneficiary; and

(3) The beneficiary did not exercise the opportunity to decline having his/her claims data shared with the ACO as provided in §425.708.

(e) At the ACO's request, CMS continues to provide ACOs with updates to the requested beneficiary identifiable claims data, subject to beneficiary's opportunity to decline data sharing under §425.708.

(f) If an ACO requests beneficiary identifiable information, compliance with the terms of the data use agreement described in §425.710 is a condition of an ACO's participation in the Shared Savings Program.

[76 FR 67973, Nov. 2, 2011, as amended at 80 FR 32844, June 9, 2015; 83 FR 68082, Dec. 31, 2018]