Enterprise Data Mesh

The Enterprise Data Mesh enables this agency to set up an enterprise-wide data lake which acts as a data marketplace, providing a catalog of data types for consuming this agency application, and as a gateway to the source data to help consumers meet their program needs. Several applications have this data stored in traditional databases or even in flat files at various data centers. 

The Enterprise Data Mesh will register the schema information from the following agency's data sources; Common Medicare Environment, Transformed Medicaid Statistical Information System, Master Data Management, Beneficiary Information in the Cloud, Quality Payment Program, and Drug Data Processing System.

The type of information received and maintained for Common Medicare Environment is the data schema pertaining to the Common Medicare Environment data source. The Common Medicare Environment data includes Medicare beneficiary demographic data used to support managed care enrollments, Payments to Medicare Advantage plans, Medicare Advantage Prescription Drug Enrollment Information, Medicare Part A, B, C, D enrollment Information, and Dual Medicare Eligibility Information. These data points describe the data schema for Common Medicare Environment. Only the headings will be stored in the Enterprise Data Mesh, not the actual data pertaining to beneficiaries that fall into these categories.

The type of information received and maintained for Transformed Medicaid Statistical Information System is the data schema pertaining to the Transformed Medicaid Statistical Information System data source. The Transformed Medicaid Statistical Information System data includes information about beneficiary eligibility, beneficiary enrollment, and claims and managed care data. Data points to convey this information include beneficiary demographics, diagnosis codes, procedure codes, as well as claims and eligibility factors.

The type of information received and maintained for Master Data Management is the data schema pertaining to the Master Data Management data source. The Master Data Management utilizes multiple disparate sources of both demographic and profile data attributes pertaining to Medicare Providers, Beneficiaries, and Organizations as well as Medicaid Recipients and Providers. The result is the creation of a trusted 360-degree profile of each entity engaged in various roles related to the Medicare or Medicaid programs.

The type of information received and maintained for Beneficiary Information in the Cloud is the data schema pertaining to the Beneficiary Information in the Cloud data source. The Beneficiary Information in the Cloud data includes information about beneficiary demographics and beneficiary enrollment. Data points to convey this information include general beneficiary demographics, as well as eligibility factors.

The type of information received and maintained for the Quality Payment Program is the data schema pertaining to the Quality Payment Program data source. The Quality Payment Program includes information about physician and clinician demographics and quality of care provided. Data points to convey this information include general demographic information on physicians, clinicians, such as specialties, practice locations, and phone numbers.

The type of information received and maintained for the Drug Data Processing System is the data schema pertaining to the Drug Data Processing System data source. The Drug Data Processing System includes information pertaining to prescription drug transactions for a beneficiary. Data points to convey this information include general beneficiary demographics, beneficiary eligibility factors, as well as prescription drug factors, including prescription code, date of service, and quantity dispensed.

The Enterprise Data Mesh will also carve out a staging area for data sources to provide extracts of their data for consumption by interconnecting with this agency's applications. This storage area is the only location for the potential storage of Personally Identifiable Information within the system. This data may contain Personally Identifiable Information elements of beneficiaries, providers, and provider organizations to include Social Security Number, Name, Mailing Address, Phone Number, Taxpayer Identification, Date of Birth and Health Insurance Claim Number. This information will be held indefinitely until no longer needed for agency use and is refreshed on a monthly cadence.

Lastly, user credentials are required for federal employees and direct contractors to gain access to the Enterprise Data Mesh. These credentials, and other information collected from these individuals, such as email address, telephone number, and name, are governed by the Centers for Medicare and Medicaid Services' Amazon Web Services General Support System and covered under their respective Privacy Impact Assessment.

Please note that all systems named here are covered under its own Authority to Operate and Privacy Impact Assessment.

The Enterprise Data Mesh application focuses on eliminating redundancy, inconsistency, and fragmentation by having a single marketplace for the Centers for Medicare and Medicaid Services applications to view the catalog of this agency enterprise data, and a gateway to data needed to meet business functions. The data schema captures the types of data from each data source but not the data itself. These data points will remain with the source systems. These data schema will be routinely refreshed to represent the current data points held within the subscribed data sets.

For data sources that have not yet moved to the cloud, or cannot conform to the necessary formats, a staging area will be created as part of the Enterprise Data Mesh where data may be stored. This data may contain Personally Identifiable Information elements of beneficiaries, providers, and provider organizations to include Social Security Number, Name, Mailing Address, Phone Number, Taxpayer Identification, Date of Birth and Health Insurance Claim Number. Circumstances will dictate if this data will be stored permanently or temporarily.

Lastly, the system collects usernames and passwords for administrators and users of the system.

• Social Security Number
• Name
• Phone Numbers
• Taxpayer ID
• Date of Birth
• Mailing Address
• Other - Health Insurance Claim Number; Usernames and passwords for administrators; Metadata.

• Employees
• Vendors/Suppliers/Contractors
• Patients

The Enterprise Data Mesh receives data from the Centers for Medicare and Medicaid Services sourced applications; Common Medicare Environment, Transformed Medicaid Statistical Information System, Master Data Management, Beneficiary Information in the Cloud, Quality Payment Program, and Drug Data Processing System. As such, the programs referenced must provide the necessary notifications to individuals.

Please note that all systems named here are covered under its own Authority to Operate and Privacy Impact Assessment. 

The Enterprise Data Mesh receives data from Centers for Medicare and Medicaid Services sourced applications; Common Medicare Environment, Transformed Medicaid Statistical Information System, Master Data Management, Beneficiary Information in the Cloud, Quality Payment Program, and Drug Data Processing System. As such, the programs referenced must provide the necessary notifications for individuals to opt-out of the stated terms of collection and use. 

Please note that all systems named here are covered under its own Authority to Operate and Privacy Impact Assessment. 

Administrator data is collected by the Centers for Medicare and Medicaid Services Amazon Web Services General Support Services during the account request and provisioning process. These notification steps are covered under their respective Privacy Impact Assessment.

The Enterprise Data Mesh receives data from Centers for Medicare and Medicaid Services sourced applications; Common Medicare Environment, Transformed Medicaid Statistical Information System, Master Data Management, Beneficiary Information in the Cloud, Quality Payment Program, and Drug Data Processing System. As such, the programs referenced must provide the necessary notifications for individuals in terms of collection and use. These notification steps are covered under their respective Privacy Impact Assessment.

Please note that all systems named here are covered under its own Authority to Operate and Privacy Impact Assessment.

• Administrators: The Enterprise Data Mesh administrators require access to provide Operations and Maintenance support which exposes them to Personally Identifiable Information.
• Developers: Developers access Personally Identifiable Information for testing and assisting in troubleshooting of issues that may occur with the application and/or data.
• Contractors: Direct contractors with the Centers for Medicare and Medicaid Services provisioned credentials (for example, Centers for Medicare and Medicaid Services Identification, Centers for Medicare and Medicaid Services electronic mail) provide the roles of Administrators and Developers.

Access to the Enterprise Data Mesh sources, including all sensitive information, is guided by the Enterprise User Administration access control process. Administrators, developers, and contractors are required to apply for the Enterprise User Administration access first. Once unique identifiers are issued, users who require access to the Enterprise Data Mesh resources including sensitive information must request Enterprise User Administration job codes. Once job codes are approved using the existing this agency's Enterprise User Administration process, users receive access to the Enterprise Data Mesh sources which may include Personally Identifiable Information, if appropriate. Any and all requests for administrative access is submitted to and approved by the Enterprise Data Mesh Business Owner before access is given. Privileged users are reviewed routinely by the Business Owner to ensure that only authorized users have privileged access to systems which may contain Personally Identifiable Information.

Please note that all systems named here are covered under its own Authority to Operate and Privacy Impact Assessment. 

The  Enterprise Data Mesh utilizes role-based access to ensure that users have only the access necessary for them to perform their job functions. The information that may be accessed is defined by the user’s role. 
The process for provisioning access to a given user, via Enterprise User Administration and associated roles, requires a determination via review and approval by the system owner, while implementation is performed via the system administrator during account provisioning.

Please note that all systems named here are covered under its own Authority to Operate and Privacy Impact Assessment. 

Administrative controls include access approval by management, and review of accounts.
Technical controls include event logging, role-based access, and networking security controls.
Physical controls in place at the Amazon Web Services Data Center monitor physical access, visitor logging, and environmental access controls.

Please note that all systems named here are covered under its own Authority to Operate and Privacy Impact Assessment.