Hospital Quality Reporting

The Hospital Quality Reporting (HQR) system supports the Centers for Medicare and Medicaid Services (CMS) by providing a suite of applications that are developed to gather medical encounter data to calculate the legislatively mandated measures, validate, and report those results for quality improvement opportunities, scoring to support annual payment update (APU) determination for participation of acute care hospitals (ACH), critical access hospitals (CAH), rural emergency hospitals (REH), inpatient psychiatric facilities (IPF), prospective payment system (PPS) exempt cancer hospitals (PCH), ambulatory surgical centers (ASC), Veteran's Health Administration (VA) and Department of Defense (DoD) facilities to ensure collection/calculation and reporting  for  the following CMS payment programs: Inpatient quality Reporting (IQR), Outpatient quality reporting (OQR), PCH quality reporting (PCHQR), IPF quality reporting (IPFQR), promoting interoperability (PI), REH quality reporting (REHQR),Hospital- Acquired Condition reduction program (HACRP), Hospital readmission reduction program (HRRP), Hospital Value-Based Purchasing (HVBP), IQR/OQR/electronic clinical quality measure (eCQM) validation, Hospital Consumer Assessment of Healthcare providers and systems (HCAHPS), Hybrid measures, and Public Reporting (PR).

Currently the HQR system collects data for approximately one hundred and twenty (120) clinical measures and supports the preview and publicly reporting of approximately three hundred and thirty (330) measures in each quarterly release.

The clinical and publicly reported measures that the HQR system is responsible for is determined in annual legislatively mandated rules for each program. Each year, CMS programs can add, remove, or modify the measures required for APU and PR. Based upon finalization of these rules, the HQR system is responsible for developmental activities to gather, receive, calculate, validate, and report these changes. CMS PPS rules are published on federalregister.gov.

The following information is collected, maintained, and shared by Hospital Quality Reporting (HQR): HQR patient personal information, patient treatment information, treatment facility aggregated measure data, treatment facility information, and treatment facility personnel information. HQR patient personal information includes:
Medical records to also include patient demographic information, insurance/payer information including unique patient identifier account number, cost data, facility information including key personnel.

CMS and their direct federal contractors also have access to HQR and supported programs by their contractual roles as administrators and developers.

All HQR users’ access hqr.cms.gov via Health Care Quality Information Systems (HCQIS) Access Roles and Profile (HARP) authenticated username, password, and multifactor identification that is managed by the QualityNet (formerly HCQIS) Enterprise line of business (LOB). QualityNet is a CMS FISMA system covered by a separate PIA. The HQR system records user credentials upon login (username, name, and email).

The Hospital Quality Reporting (HQR) system performs measure calculation for several measures from data received directly from hospital organizations. The data submitted to the HQR system is either patient level data or submitted in aggregate for the patient population of that organization based upon the measure specifications provided by the Centers for Medicare & Medicaid Services (CMS). The HQR system also receives aggregate organization data from external sources, such as the Centers for Disease Control and Prevention (CDC).

Additionally, the HQR system pulls Medicare claims data from the Centralized Data Repository (CDR), a CMS managed data base. This data is used to evaluate and score hospitals performance for each measure that is applicable to their organization, as well as provide scoring against all participating hospitals in their state and nation. The aggregated scores are shared with individual hospitals prior to being shared with the Care Compare website at https://www.medicare.gov/care-compare/ where the public can view the scores of their local facilities to be able to choose the best facility for their needs. The data used for calculations by the HQR system is determined by the measure specifications, most can be found here https://qualitynet.cms.gov/ or here https://ecqi.healthit.gov/. 

Measures calculated by the system, whether it be from patient level or facility level data, are submitted in the following measure types:

Structural Measures/ Web-based Measures/ Attestation Measures/Center for Disease Control (CDC) Hospital Acquired Infection (HAI), CDC Flu Vaccination Immunization, CDC Covid Vaccination Immunization. This is aggregated data at the facility level and contains no Personal Identifiable Information (PII)/Protected Health Information (PHI) and comes in the form of a denominator (total population) and numerator (total affected population), yes/no responses, or pre-calculated facility rate information. The CCN and submission quarter is collected and stored with the aggregated data along with the submitter information.

Chart Abstracted Measures. This data is received by the system in patient level data files and population data.
The patient level data includes Name, Date of Birth, race/ethnicity, sex, Measure data (Measure Sets, Individual Measures), Provider/Vendor data (CMS Certification Number, National Provider Identifier), Encounter Data (Admission Date, Discharge Date, Diagnosis codes, Procedure codes). This data is used to calculate the quality of care provided to the patient, and then aggregated to provide the facility, state, and national rates. This data is stored for validation purposes and public reporting on the Care Compare site.
Population data is provided, but it does not include PII/PHI. It provides CMS an understanding of the total population that care was provided for a given measure population, and how many actual cases were reported to CMS per the measure requirements. This information is reported to the facilities and CMS but is not shared publicly.

Claims-based Measures/ eligible claims. Part A, Part B, and Part D claims data is retrieved from Center for Medicare and Medicaid (CMS) claims data bases, post facility submission and payment for covered services to calculate the claims-based measures and provide facilities the counts of claims submitted for a given time. This data includes patient demographics (name, birthdate, date of death, sex, medical records information (procedure, medical treatment, encounter dates, diagnoses), Medicare Beneficiary Identification number (MBI), Health Insurance Claim Number (HICN), Social Security Number (SSN), and cost information per the measure specifications. Claims-based measures are calculated at the facility, state, and nationally for public reporting on the Care Compare site, and some measures are used for risk adjustment which impact Annual Payment Updates (APU). HICN are being stored in the system for previous reporting periods for claims-based measures but are not currently being accepted. SSN are only used to evaluate claims-based measures for VA hospitals to map to Medicare claims in the system. In the future, Part C data will also be used to calculate these measures.

eCQM Measures/ Hybrid measures.  eCQM measures are submitted in a format that is equal to an electronic version of a medical chart that contains data including patient demographic data (Name, Mailing Address, Date of Birth, Email, race/ethnicity, sex), Measure data , Provider/Vendor data (CMS Certification Number, National Provider Identifier), Encounter Data (Admission Date, Discharge Date, Procedure codes, International Classification of Diseases (ICD-10) diagnostic codes, lab results, medical record number), Payer information (Medicare Beneficiary Identification number (MBI), private health insurance information). This data is used to evaluate against the measure specifications to calculate the quality of care provided to the patient, and then aggregated to provide the facility, state, and national rates. This data is stored for validation purposes and public reporting on the Care Compare site.
Hybrid measures are a combination of eCQM measures and claims-based measures. To calculate these measures, the data that is obtained from the eCQM file submission is mapped to Medicare claims in to achieve a risk adjusted outcome for the hospital based upon its patient population.

Survey data-
HCAHPS Survey data includes Patient satisfaction survey responses on aspects of the hospital experience such as communication with doctors, communication with nurses, responsiveness of hospital staff, cleanliness of the hospital environment, quietness of the hospital environment, pain management, communication about medicines, discharge information, overall rating of hospital, and recommendation of hospital. This information is aggregated and reported through to the Care Compare site.
Patient reported outcomes data includes patient demographics (height, weight, birth date) procedure type, procedure date, Medicare Beneficiary Identification number (MBI), patient evaluation of pain and activities of daily life (ADLs) for pre and post procedure. This data is used to map to claims to evaluate the patient reported experience of wellness prior to and after an elective surgical procedure to provide facility level outcomes. While this data is being collected and stored, it is not currently being shared as an overall score of the facility.

Provider and Vendor demographics include Hospital name, CMS Certification Number (CCN), National Provider Identifier (NPI), Mailing Address, Email, contact telephone. This data is collected to ensure active status of providers and vendors, as needed for access and permissions to the HQR system, and for program requirements of participation.

In addition, the data collected also provides CMS the information needed to measure and improve the quality care of CMS’s HQR programs for future measures. 

PII - HQR uses PII to retrieve system records for the Claims product mentioned above. This includes using the first name, last name, MBI, SSN (VA only), and Date of Birth (DOB) to identify claims related to measure data submissions. The HQR system currently uses the CMS IDR Medicare database for payment cost measures, but most of the claim's data is obtained through the Centralized Data Repository CDR. All SORN notices have been included in question 22a for current and future claims data sources.

• Social Security Number
• Name
• E-Mail Address
• Phone Numbers
• Taxpayer ID
• Date of Birth
• Mailing Address
• Medical Records Number
• Employment Status
• Date of Death
• Other - Patient level data: Medicare Beneficiary Health Identification Number (MBI), CMS Certification Number (CCN), National Provider Identifier (NPI), Health Insurance Claim Number (HICN), Payer information HARP Account Credentials (User ID, name, email) and associated HQR permissions that are managed through the access management application. Medical records information: encounter dates, procedure date, procedure codes, diagnostic codes, lab results, Patient demographic data, claims data, claim payment cost information, claim number. It also collects facility information, including name, location type of facility, services provided and including name, location, type of facility, the services provided (number and type of treatment) and facility personnel information (name, facility email and phone number, position, and employee status)

• Patients
• Other - User credentials that may contain PII are stored in the system for auditing purposes. This can include employees, public citizens working within an organization submitted patient data, or direct contractors accessing the system. Login information is shared in the Centralized Data Repository (CDR).

Medicare Integrated Data Repository (IDR): 09-70-0571

Centralized Data Repository (CDR):
SORN 09-70-0558
SORN 09-70-0553
SORN 09-70-0548
SORN 09-70-0548
SORN 09-70-0539
SORN 09-70-0528
SORN 09-70-0522
SORN 09-70-0502

• In-Person
• Online

• Within the OPDIV
• State/Local/Tribal

• Private Sector
• Other - Centralized Data Repository (CDR), Integrated Data Repository (IDR)

• Users: Health Care providers will have access to PII pertaining to Health Service Encounters (HSE) they perform. HQR users have access to the PII in the system to register, handle patient billing, and maintain patient records in HQR programs. CMS users have access to data for all HQR programs.
• Administrators: Database administrators and database personnel may have access to maintain the system and create the exports of the information from the system, as necessary. System administrators would not have access to PII, except on a limited, by exception basis.
• Developers: Four developers have access to claims data for CMS program reporting services.
• Contractors:  CMS direct contractors, in their roles as database and systems administrators, may have access to the PII for the purpose of troubleshooting and maintaining the system and creating export data.

Access to PII is granted using the principles of least privilege and need to know; users are only granted access to PII based on their job responsibilities needed to perform their assigned duties. Role creation involves an analysis for the role definition and type of access.

HQR users must register for a Health Care Quality Information Systems (HCQIS) Access Roles and Profile (HARP) ID, that requires user name, password, and multifactor authentication.
After the individual is approved for a user ID, to access hqr.cms.gov, the person must request access to an organization (or alternatively the organizations Security Official (SO) can add the user by HARP ID), and is assigned a role which determines the amount, and type, of information that is accessible and visible to the user.

Access is defined in the specific HQR Program's participation prospective payment rules and state that the Security officials (SO) are responsible for maintaining secure access to their organization's data.

A system user fills out the Production Request form, they enter the specific database/environment they need access to and the access level that is necessary to perform their job. These are then approved or disapproved by CMS approvers.

Security information and event management (SIEM) tools are used to monitor access and detect anomalies. Any anomalies are addressed and resolved by contacting the user, modifying their user access, or by removing their access if no longer required. Activities of all users including system administrators are logged and reviewed to identify abnormal activities.

Security and privacy awareness training is provided to each user on an annual basis. All users are required to complete training to obtain a user account and annually thereafter.

Required training includes annual Department of Health and Human Services (HHS) Information Systems Security Awareness Training, annual HHS Privacy Training, reading, and attesting to the Rules of Behavior for Use of HHS Information Resources (HHS RoB).

Role-based training is required for those with significant information security and privacy responsibilities.  HQR system administrators, developers and direct contractors are required to complete annual role-based training.

A sample list of role-based training includes Incident Response exercises, Contingency Planning exercises.

Administrative controls include annual security and privacy training for the proper handling of information, configuration management, change management, periodic review of users and deletion or revoking of user accounts.

Technical controls include multi-factor authentication, session locks, encryption, firewalls, vulnerability scans, penetration testing, and monitoring.

Physical controls include a secure AWS data center, video surveillance, intrusion detection systems, uninterruptible power supply (UPS), back-up generators, environmental controls to maintain a constant operating temperature, smoke detection sensors, and sprinkler systems.