Drug Data Processing System

The Centers for Medicare & Medicaid Services (CMS) implemented the Drug Data Processing System (DDPS) to support CMS’ implementation of a new prescription drug benefit program for Medicare mandated by the Medicare Prescription Drug Improvement and Modernization Act (MMA) of 2003. This system processes all Medicare covered and non-covered prescription drug events (PDEs) and related data, including non-Medicare drug events as necessary, to validate/authenticate Medicare payment of covered drugs made by plans for Medicare beneficiaries enrolled in Part D.

Payment Reconciliation System (PRS) aggregates payment data from Medicare Advantage and Prescription Drug (MARx) system, prescription drug event (PDE) data from the Drug Data Processing System (DDPS), and bid/direct and indirect remuneration data from the Health Plan Management System (HPMS) in order to perform the calculations for the Part D payment reconciliation.

• Name
• Phone Numbers
• Medical Notes
• Date of Birth
• Mailing Address
• Medical Records Number
• Other - detailed and summary beneficiary prescription drug claim data, health insurance claim number (HICN)/Medicare Beneficiary Identifier (MBI), card holder identification number, date of service, sex, date of birth, provider characteristics, prescriber identification number, assigned provider number (facility, referring/servicing physician), national drug codes, beneficiary, plan, and supplemental payment amounts. System user credentials: user ID and password.

• Business Partners/Contacts (Federal, state, local agencies)
• Vendors/Suppliers/Contractors
• Patients

09-70-0553: Medicare Drug Data Processing System (DDPS)

• Within the OPDIV
• Other Federal Entities

Data used in the Drug Data Processing System has already been collected and validated from other CMS systems and are covered under individual Privacy Impact Assessments. Therefore, no OMB information collection approval number is required. The information collected in person online is system user credentials for CMS employees and CMS direct contractor support personnel. 

Payment Reconciliation System (PRS) aggregates payment data from Medicare Advantage and Prescription Drug (MARx) system, prescription drug event (PDE) data from the Drug Data Processing System (DDPS), and bid/direct and indirect remuneration data from the Health Plan Management System (HPMS) in order to perform the calculations for the Part D payment reconciliation.

• Users - Benefit implementation, program administration and oversight.
• Administrators - System Administration
• Developers - Staff necessary to develop test and maintain the system
• Contractors - Direct Contractors require access to DDPS for developing and maintenance of the application. They also test and maintain code and system functionality.

CMS Security Awareness and Privacy training is provided to personnel on an annual basis and acknowledge successful training after passing a test at the end of training and the system verifies completion. Included in the training is education about how to properly handle sensitive data, general security awareness, notations of conflict of interest, and import/export restrictions. A separate training for Records Management is also completed annually. 
Personnel with significant security roles take role-based trainings in addition to the CMS Security Awareness and Records Management training. This additional training is also conducted annually, and is tailored to an individual's role within the program and varies depending on the desired role.

All staff that work projects that fall under HHS and its Operating Divisions must take HIPAA, and security policy training and acknowledgment. Additionally, all staff that work on HHS projects must acknowledge understanding and compliance with HHS rules of behavior.

Outputs of the DDPS, which provide summary data of all annual prescription approvals, are temporary and cut off annually; the outputs are then deleted and destroyed 20 years after cutoff. (Disposition Authority: N1-440-09-4, Item 1d). The records disposition is permanent and to be cut off annually. Pre-accession files to the National Archives are 5 years after cutoff. DDPS will legally transfer individual files in an acceptable format (following current CFR guidelines) to the National Archives annually, 20 years after cutoff and will include an electronic copy of the system documentation (i.e., code books, record layout, user guides and any other technical specifications) with the transfer. (Disposition Authority: pending NARA approval).

Per the Office of Strategic Operations & Regulatory Affairs (OSORA) standards, DDPS also retains the following data criteria in addition to the above NARA disposition authority: Financial Records, Beneficiary Records, Compliance and Integrity. Financial Records retention states, "Destroy no sooner than 7 year(s) after cutoff but longer retention is authorized." Beneficiary Records retention states, "Destroy no sooner than 10 year(s) after cutoff but longer retention is authorized." Compliance and Integrity retention period states, "Destroy no sooner than 7 year(s) after cutoff but longer retention is authorized." DDPS is compliant with all the record retention requirements derived from OSORA, and documented in NARA per DDPS retaining system data indefinitely.