Centralized Data Exchange

Types of information CDX receives, stores, and validates include Medicare Beneficiary Identifier (MBI), National Provider Identifier (NPI), Medical Records Number, Tax Identification Numbers (TIN), Medical Notes, Mailing Address, Clinical data, Sociodemographic data (e.g., age, sex, education, migration background and ethnicity, religious affiliation, marital status, household, employment, and income), and social needs data (e.g., food insecurity, housing instability, or social isolation).

CDX will receive, store, and maintain all data that is uploaded to CDX. The user can delete the files from the User Interface, but the information will be retained in the database until it is archived per the data retention policy. All users will only have access to data that they originally uploaded into CDX or was shared with them by a user that had access to that data in CDX. A user’s ability to share data that was shared with them and not originally posted by themselves, depends on their user role.

Data will be stored in accordance with each Model team requirements and allow the submission of data using multiple formats. All models will be able to share data through CDX utilizing its sharing capability.

CDX utilizes user ID and passwords, and these login credentials are used to grant access to the system. The CDX end users include CMS internal users (system owners and operators, model teams, and direct contractors) and external entities (model participants and their respective business associates/representatives). The login credentials (user ID) used to access CDX are provided to users by CMS enterprise identity management system.

CDX provides the capability to replace the current file upload/download features embedded into individual systems with one centralized CMMI file exchange solution. 

CDX provides a user interface (UI) to enable users to perform ad-hoc exchanges and uses APIs to exchange data via fast healthcare interoperability resources (FHIR) and other APIs according to the interoperability rules of the Affordable Care Act. 

PII including MBI, NPI, Medical Records Number, TIN, Medical Notes, Mailing Address, Clinical data, Sociodemographic data (e.g., age, sex, education, migration background and ethnicity, religious affiliation, marital status, household, employment, and income), and social needs data (e.g., food insecurity, housing instability, or social isolation) is received, stored in and shared through the service that CDX provides to those with access.

Login credentials are provided by CMS's enterprise identity management system and used to grant access to the system. The primary consumer of the CDX service is the Model Team and Model Participants. The CDX end users include CMS internal users (system owners and operators, model teams, and direct contractors) and external entities (model participants and their respective business associates/representatives). 

• Name
• Medical Notes
• Taxpayer ID
• Mailing Address
• Medical Records Number
• Other - MBI, NPI, Clinical data, Socio demographic data like Sex etc., social needs data include but not limited to Food Insecurity, Living Situation, Transportation etc.

• Business Partners/Contacts (Federal, state, local agencies)
• Vendors/Suppliers/Contractors
• Patients
• Other - Model Participants

• Within the OPDIV

The information that is submitted is sourced from existing medical records that have already been collected by the provider. Responsibility for patient notification resides at the point of information collection from the individual. However, all Medicare participants are provided with a Notice of Privacy Practice that states that although they can elect to not share data for certain processes, as a condition of participating in Medicare, their information will be shared for certain purposes, such as quality assessment and reporting.

CDX user’s authentication is provided by CMS's enterprise identity management system and used to grant access to the system.

The information that is submitted is sourced from existing health related data that have already been collected by the provider. Responsibility for patient opt-out process resides at the point of information collection from the individual. 
The provision of PII is "voluntary" as that term is used by the Privacy Act.

All system user login credentials are provided by CMS's enterprise identity management system and used to grant access to the system. 

The information that is submitted is sourced from existing medical records that have already been collected by the provider. Changes to CDX that would involve changes in uses and disclosures of beneficiaries' PII are not expected to occur. If such changes were to occur, CMS will inform individuals using multiple channels, including direct mailings; notices on the CMS website (including edits to CMS's posted privacy policy), or changes to the relevant systems of records notices.

Changes involving uses and disclosures of authentication information are also not expected to occur. In the event of such changes, employees will be notified by notices on the CMS intranet; newsletters; updates to the relevant systems of records notices; e-mails to affected individuals; and through supervisors and system owners.

The information that is submitted is sourced from existing medical records that have already been collected by the provider. Responsibility for patient concerns regarding the use of PII resides at the point of information collection from the individual. 

If an individual has concerns that their PII has been inappropriately obtained, used, or disclosed or that the PII is inaccurate, the following procedures should take place: If the user believes an incident has occurred, the user should cease what they are doing and notify Model Specific Helpdesk. The Help Desk will create a ticket and will notify CDX Management and CDX Security team. CDX security team will investigate the event.

If reportable, security will notify the CMS Help Desk within 1 hour of the incident occurring. (If the event is unreportable, security will notify the Help Desk to close the ticket). The CMS Help Desk Representative will serve as the CMS First Respondent in documenting and assessing the incident to ensure that the incident has been contained. The incident will be escalated and routed to the appropriate CMS group per CMS Incident Response Policy to determine the severity and course of action for mitigation.

System user's credential information is collected via registration with CMS's authentication system; therefore, no process exists within CDX to address these concerns. Any perceived issue should be reported to the CMS Help Desk and escalated to the CMS authentication system administrators.

CDX does not directly collect data from individuals. CMS IS2P2 requires business owners to Conduct initial evaluation of PII/PHI holdings and review holdings annually to ensure, to the maximum extent practicable, that such holdings are accurate, relevant, timely, and complete and reduce PII holdings to the minimum necessary for the proper performance of the documented CMS function for all information systems containing PII/PHI.

Data availability is protected by security controls selected as appropriate. CDX follows the CMS Security and Privacy program and complies with the CMS Acceptable Risk Safeguards, and National Institute of Standards and Technology (NIST) documents such as its Special Publications to select controls appropriate to the level of risk of the system, determined using NIST's Federal Information Processing Standard 199.

• Users: Each user should have access to their own PII, to perform tasks relating to their own account.
• Administrators: Administrators responsible for system operations and maintenance tasks may be exposed to user's PII.
• Contractors: Direct contractors who have system administration roles may also be exposed to the user's PII that is stored in the system as part of their approved responsibility.

User roles are established and managed in a way to ensure that users are only able to access data that pertains to their own organization. Roles are assigned and access is granted, to CDX and the PII it contains, based upon principle of least privilege, and "need-to-know" or "need-to-access" requirements to perform their assigned duties. 

System Administrators review user accounts at least semi-annually. Any anomalies are addressed and resolved by contacting the user, or by removing their access if no longer required. Activities of all users are logged and reviewed by the system administrator to identify abnormal activities, and if any are found they are reported to the business owner, and the ISSO.

All CMS employees and direct contractors are required to complete mandatory security and privacy awareness training prior to gaining access to the CMS Network. Each year, thereafter, the user must get recertified. In the event they fail to complete the recertification training, the user's access will be terminated.

All CDX end-users will be provided notification at the commencement of each session, to make them aware of their responsibilities for protecting the PII/PHI information being shared, collected and maintained.

The application adheres to data retention and destruction policies/procedures that follow National Archives and Record Administration (NARA) guidelines related to data retention and NIST guidelines related to data destruction. More specifically, CDX adheres to the following NARA general records schedule guidelines: 

DAA-0440-2015-0007-0001; Destroy no sooner than 10 year(s) after cutoff but longer retention is authorized.

And

DAA-GRS-2013-0005-0003, 5-year retention.