CMS QIO Platform

All data in the CQP originates from other CMS authorized systems (internal and operational) or by direct entry by Quality Improvement Organizations (QIO) program support contractors. Data that is ingested from CMS operational systems is limited to data from the Program Resource System (PRS) which is part of the QualityNet Enterprise Services (Qnet-ES) Federal Information Security Management Act (FISMA) system and the Center for Clinical Standards and Quality (CCSQ) Data Repository and Analytics Platform (CDRAP) FISMA system. Both systems have their own Privacy Impact Assessment (PIA) respectfully. CQP User accounts are created via Health Care Quality Information Systems (HCQIS) Access Roles and Profile (HARP)/Okta (Qnet-ES FISMA system) Just-In-Time (JIT) provisioning and will not be manually entered. The user record is created once the user accesses the CQP Access Portal site. CQP collects and maintains user's username, first name, last name and email address for all CQP users (federal employees and contractors).  

Provider Contact details captured is entered by QIO Contract personnel and collects provider information: Name, Office/mailing Address, Phone Number, email address, Tax Identification Number (TIN), CMS Certification Number (CCN) and National Provider Identifier (NPI).  

CQP supports the following processes: enrollment of priority providers; initial and ongoing provider level assessments to define the organizational readiness and the needs and priorities of a particular community and its participants; approval process for Provider Quality Action Plan, documentation of QIO interventions, and reporting of quality outcomes and performance metrics. Users of the CQP system are required to provide some personally identifiable information (PII) to uniquely determine eligibility and identify approved personnel and contractors accessing the CQP system. The provider data that is collected is used to administer and evaluate data driven initiatives including enrollment, assessments, quality action plans, intervention activities, outcome reporting and supports issuance of notices.    

CQP supports the following processes: enrollment of priority providers; initial and ongoing provider level assessments to define the organizational readiness and the needs and priorities of a particular community and its participants; approval process for Provider Quality Action Plan, documentation of QIO interventions, and reporting of quality outcomes and performance metrics.

Users of the CQP system are required to provide some PII in order to uniquely determine eligibility and identify approved personnel and contractors accessing the CQP system.  

The provider data collected is used to administer and evaluate data driven initiatives including enrollment, assessments, quality action plans, intervention activities, outcome reporting and will support issuance of notices.

• Name
• E-Mail Address
• Phone Numbers
• Taxpayer ID
• Mailing Address
• Other - The CQP system may collect provider information which includes Name, Office/mailing Address, Phone Number, email address, Tax Identification Numbers (TIN), National Provider Identifier (NPI) and CMS Certification Number (CCN). Note: Office/Mailing address may also be a home address if an individual provider has a practice set up in their home. CQP user information collected includes the following user profile attributes:User.Username (user.email)User.FederationIdentifier (user.login)User.FirstName (user.firstName)User.LastName (user.lastName)User.Email (user.email)Contact.LastName (user.lastName)User.Profield (Customer Community Plus Login User CMS)Contact.FirstName (user.fisrtName)Contact.RecordType (CQP Portal)User.Account (CQP Portal)

• Employees
• Public Citizens
• Business Partners/Contacts (Federal, state, local agencies)
• Vendors/Suppliers/Contractors
• Other - The CQP system may collect provider information which includes Name, Office/mailing Address, Phone Number, email address, Tax Identification Numbers (TIN), National Provider Identifier (NPI) and CMS Certification Number (CCN). Note: Office/Mailing address may also be a home address if an individual provider has a practice set up in their home.

• Code of Federal Regulations (CFR) 42 Section 494. 180 (h) and Sections 226A, 1875, and 1881 of the Social Security Act (the Act) (Title 42 United States Code (U.S.C.), sections 426–1, 1395ll, and 1395rr).
• TRHCA - 2006 Tax Relief and Health Care Act.
• MMSEA - Medicare, Medicaid, and SCHIP Extension Act of 2007.

• Published: 09-70-0536 - Medicare Beneficiary Database (MBD) published 12/4/2006.
• Published: 09-70-0538 - Individuals Authorized Access to Centers for Medicare & Medicaid Services (CMS) Computer Services (IACS) published 7/26/2002 and updated 12/13/2007 

• Online

• Within the OPDIV

• Private Sector

• Within HHS Explanation: PII is to be shared or disclosed in support of the QIO Program related operational processes and oversight.

HARP supports CQP Account Management and Identification and Authentication of users that are registered through HARP prior to being approved for a role in the CQP (Salesforce) Portal. HARP is responsible for verifying the accuracy of PII collected on the user's behalf during the registration process.  The internal user accounts are synced with HARP so that if an edit is made, (i.e. editing an email address) the email address in Salesforce will reflect the changes. 

Information is received from other QualityNet systems for use in the CQP system on an as-requested basis. All data is checked upon import to ensure the information received is complete and relevant. Once the data is in the CQP environment, information stores are backed-up in accordance with CMS requirements. Database integrity checks are performed on a scheduled basis to ensure that information has not been compromised. Functionally, reviewers assess the completeness, relevancy, and accuracy of quality review information as part of their review process integral to the work process.

Additionally, the Privacy Impact Assessment document and System Security Plan will be reviewed annually. Annual Adaptability Controls Testing (ACT) is conducted to ensure compliance with the CMS Acceptable Risk Standards (ARS).

• Users: QIO Users who are privileged to see PII/PHI will be able to do so after requesting the appropriate permissions for review and getting approval by a Security Officer, in order to do their work within the CMS QIO Platform (CQP).
• Administrators: Approved Contractors and CMS system administrators will have full access to see PII/PHI will be able to do so after requesting the appropriate permissions for review and getting approval by a Security Officer, in order to do their work within the CMS QIO Platform (CQP).
• Contractors: QIO Direct Contractors who are privileged to see PII/PHI will be able to do so after requesting the appropriate permissions for review and getting approval by a Security Officer, in order to do their work within the CMS QIO Platform (CQP).

Access requests are to be tracked within CQP. Each contract organization will have a Security Officer (SO) responsible for approving/vetting requests and higher-level administrator access, is to be reserved for Administered Data Objects (ADO) team and CMS.    

CQP access to PII is based on a user’s specific job function, or role. Each role is evaluated for the minimum necessary access levels needed of the role to perform the tasks necessary for the job. These roles are formally validated and serve as the basis for access to all PII. When an individual is hired, they are onboarded onto CQP and will request a role that will go out to their Security Officer. Once access requests are reviewed and approved, they will be assigned permissions automatically by the system, that may allow them access to PII/PHI data, if required to perform their work duties.

For planning, approving, and auditing, CQP uses a Roles and Responsibilities matrix to review and track what roles are available for request and what permissions those roles will have that is aligned to CQP system features and data sets, which will be consistent with program level Data Use Agreements (DUA).

As QIO contractor and organizations are added. All changes to the role and permissions mapping logic within the system will go through peer review before released. Users will only be assigned these pre-configured roles and permissions after requesting them within CQP and an approval has been obtained by their assigned Security Officer. 

Administrative Controls: Include, but not limited to contingency plans and annual testing, backups of all files, offsite storage of backup files, background checks for all personnel, incident response procedures for timely response to security and privacy incidents, initial security training with refresher courses annually, and annual role-based security training for personnel with assigned security roles.

Physical Controls: The physical security of the Salesforce Government Cloud Plus Cloud Service Provider (CSP) where the system resides is a Federal Information Processing Standards (FIPS) 199 Security Category High-Impact and includes the use of access cards for entry, security guards, and video monitoring.

Technical Controls: Include but are not limited to user authentication with least privilege authorization, firewalls, intrusion Detection and Prevention systems, encrypted communication (data at rest and data in transit, using FIPS 140-2 requirements). Hardware is configured with a deny all/except approach, auditing, and correlation of audit logs from all systems.

Management Controls: Include but are not limited to Certification and Accreditation (C&A), annual security assessments, monthly management of outstanding corrective action plans, ongoing risk assessments, and automated continuous monitoring.