Internet Quality Improvement and Evaluation System

• PIA Validation (PIA Refresh/Annual Review)

The Internet Quality Improvement and Evaluation System (iQIES) supports the Center for Clinical Standards and Quality (CCSQ) in its functions to coordinate the Centers for Medicare & Medicaid Services (CMS) quality programs and oversee survey, certification, and enforcement programs. iQIES supports CMS in its coordination of national Medicare program policies and operations. Business owners in these Centers determine what type of data iQIES collects.

iQIES supports the collection, analysis, and reporting of provider and beneficiary specific outcomes of care and performance data across a multitude of delivery websites for use in improving the quality of services provided by the Medicare and Medicaid programs.

iQIES consists of databases housed at CMS with direct access for CMS staff, state agency staff, providers and suppliers, approved accrediting organizations, and other approved users.

iQIES provides software for nursing homes, home health agencies, inpatient rehabilitation facilities, long term care hospitals and swing bed facilities to collect assessment data on residents/patients, submit it to CMS and generate reports in support of participation in CMS quality reporting initiatives and programs.

iQIES provides software for state and federal users to certify providers and suppliers, schedule surveys, collect and track survey results, record and track complaints or incidents, and implement enforcement activities. 

Providers, State Agency staff, CMS Regional and Central Office staff, and other approved users will be able to run standard, pre-determined reports through the iQIES reporting features that will run against a national database containing assessment and survey and certification data. 

QTSO: Quality Improvement and Evaluation Technical Support Office (QTSO) is a public facing website (QTSO). Some of the pages are restricted to authorized users. It provides different types of CMS users (such as Providers, Vendors, State Agencies, Regional and Central Offices) the ability to view relevant information such as news and announcements, articles, memos, guides and manuals, training materials, access requests forms, software downloads and instructions of how to download software, links to submissions web applications for Providers and web applications that are available for CMS and State Agencies. 

The business purpose of the site is to make information available to the public and specifically provide technical information to CMS providers, vendors, CMS Regional and Central offices, and State Agencies that make use of this information. The content approved by CMS is published by the Content Editor.

Information used within iQIES includes Name, Date of Birth (DOB), Social Security Number (SSN), mailing address, phone number, email address, Provider Name, Provider Number, National Provider Identification Number, Medical Notes, Medical Record Number, Health Insurance Claim Number (HICN), race/ethnicity, and sex. Other PII includes User Credentials (User ID and Password).

QTSO: QTSO collects User Credentials (User ID and Password).

iQIES is a national repository that contains resident and patient assessment data. It includes clinical data of patients and residents. The data offers a multidimensional view of residents/patient's functional capacities. It is used to collect and validate data on provider and beneficiary specific outcomes of care and performance for use in improving the quality and cost effectiveness of services provided by the Medicare, Medicaid, and Clinical Laboratory Improvement Amendment (CLIA) programs.  iQIES replaces functionality provided by the legacy Quality Improvement and Evaluation System (QIES) and provides a common look and feel, collects only the data that is needed, all while making the system more accessible, portable and intuitive to use than QIES. iQIES eliminates the complex web of multiple databases and external process needed to move, consolidate, and manage data in QIES.  iQIES will be a single solution with many services that is secure, web-based, nimble to enhance, and efficient to manage. iQIES will reside in Amazon Web Services (AWS) on a private cloud platform.

The following directives are in place with regards to information retention for iQIES:

As of October 7, 2019, CMS approved a 10-year record retention policy which applies to both patient assessment and survey/certification records.  This new policy is effective immediately.  Therefore, the new business rule for assessment data is to delete 10 years from the assessment 'Target Date', except for assessments with a known exclusion. A known exclusion is when an assessment record is past the data retention period, but is associated with a current litigation hold, then the assessment would be excluded from the deletion process.

iQIES Intermediary Records: Inputs and outputs are retained in accordance with NARA GRS 5.2, Item 020.  Temporary. Destroy upon verification of successful creation of the final document or file, or when no longer needed for business use, whichever is later.

iQIES collects both PII and non-PII patient data from patient assessments that are submitted by health care providers. This includes Name, Date of Birth (DOB), Social Security Number (SSN), Provider Name, Provider Number, National Provider Identification Number, Medical Notes, Medical Record Number, Health Insurance Claim Number (HICN), race/ethnicity, and sex.  iQIES collects the following PII to allow providers to search for patients they will be submitting assessments for, Name, Date of Birth (DOB) and Social Security Number (SSN). Users can only retrieve patient records for providers that are linked to their iQIES account through the user role access request process.

QTSO: QTSO stores and collects only non-PII and non-PHI information, such as news and announcements, articles, memos, guides and manuals, training materials, access requests forms, software downloads and instructions of how to download software, links to submissions web applications for Providers and web applications that are available for CMS and State Agencies. 

• Social Security Number
• Name
• Date of Birth
• E-Mail Address
• Mailing Address
• Phone Numbers
• Medical Records Number
• Medical Notes
• Other - Provider Name, Provider Number, National Provider Identification Number, Health Insurance Claim Number (HICN), Race/ethnicity, and sex. User Credentials (User ID and Password) are used to gain access to the system.

• Employees
• Vendors/Suppliers/Contractors
• Patients

iQIES contains resident, patient assessment, and clinical data. The Personally Identifiable Information (PII) and Protected Health Information (PHI) is used for payment, quality of care, and tracking/processing complaints and incidents reported against Medicare and Medicaid providers and suppliers. The purpose is to measure outcome monitoring, patient risk factors, and to aid in the administration of the survey and certification of Medicare and Medicaid providers, suppliers, and laboratories enrolled in the CLIA program.

QTSO: User Credentials (User ID and Password) are required for access to the site. 

iQIES uses the SSN to ensure accuracy in matching the claim to the appropriate beneficiary and provide proper payment).

iQIES users are CMS Central Office and Regional Office staff, States, and surveyors.  iQIES also shares data with State agencies, Fiscal Intermediaries (FIs), Regional Home Health Intermediaries (RHHIs), and Quality Improvement Organizations (QIOs) for the purpose of health care quality and payment. Data may also be disclosed to entities that meet Privacy Act requirements for routine use as stated in the System of Record (SOR).  These entities must have a Data Use Agreement (DUA). iQIES uses several patient identifiers together, one being the SSN, to ensure an accurate matching so that an episode/stay is created for each patient.  The episodes/stays are used to calculate quality measures (QMs), which use multiple assessments for each patient for each provider. These measures are publicly reported by CMS.  In addition, CMS uses patient assessments to determine payment for each Medicare beneficiary.

QTSO does not collect the SSN. 

Medicare Improvements for Patients and Providers Act (MIPPA), 1974, Section 153c

Medicare, Medicaid and SCHIP Extension Act (MMSEA), 2007

Medicare Improvements for Patients and Providers Act (MIPPA), 2008

Health Insurance Portability and Accountability Act (HIPAA), Privacy Rule

Tax Relief and Health Care Act (TRHCA)

Affordable Care Act (ACA), 45 CFR 155.210(e)

5 USC Section 301, Departmental Regulations

QTSO: N/A

iQIES: 

ASPEN Complaints/Incidents Tracking System (ACTS) 09-70-0565
Hospice Item Set (HIS) 09-70-0548
Inpatient Rehabilitation Facilities – Patient Assessment Instrument (IRF-PAI) 09-70-0521
Long Term Care Hospitals Quality Reporting Program (LTCH QRP) 09-70-0539
Long Term Care Minimum Data Set (LTCMDS) 09-70-0528
HHA Outcome and Assessment Information Set (OASIS) 09-70-0522

QTSO: N/A

• Online

• Other HHS OPDIV
• State/Local/Tribal
• Other Federal Entities

• Private Sector

• Within HHS: Centers for Disease Control and Prevention (CDC) to meet joint agency priorities related to Healthcare Associated Infection (HAI) prevention and quality reporting and improvement initiatives.
• Other Federal Agency/Agencies: Social Security Administration (SSA) uses the admission and discharge information for care received to administer the Supplemental Security Income (SSI) program efficiently and to identify Special Veteran’s Benefits (SVB) beneficiaries who are no longer residing outside of the United States
• Private Sector: Payment and quality of care from the following healthcare providers: Hospitals, Home Health Agencies, Psychiatric Residential Treatment Facilities, Portable X-Ray Suppliers, Outpatient Physical Therapy / Speech Language Pathology Providers, End-Stage Renal Disease Facilities, Intermediate Care Facilities for Individuals with Intellectual Disabilities, Rural Health Clinics, Comprehensive Outpatient Rehabilitation Facilities, Ambulatory Surgical Centers, Hospices, Organ Procurement Organizations, Community Mental Health Centers, Federally Qualified Health Centers, Clinical Laboratories, and Nursing Homes. 
• State or Local Agency/Agencies: Track and process complaints and incidents reported against Medicare and Medicaid providers and suppliers.

Disclosure of Nursing Care Facility Admission and Discharge Information, Identifier: SSA Match #1076 | CMS Match #2016-05 | HHS DIB #1611 Recipient: Social Security Administration (SSA)

Interagency Agreement (IAA), CMS IAA #IA16-212 and CMS IAA #IA16-213, Recipient: Centers for Disease Control and Prevention (CDC)

iQIES follows CMS Incident Response and Breach Notification Procedures. 

The Privacy Act of 1974 (5 U.S.C. § 522a) and the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule (45 C.F.R Parts 160 and 164), allow the Centers for Medicare and Medicaid Services (CMS) to disclose information without an individual’s consent if the information is to be used for a purpose that is compatible with the purpose(s) for which the information was collected. Any such compatible use of data is known as a ‘‘routine use.’’ The proposed routine uses in this system meet the compatibility requirements of the Privacy Act.

Authorized PII/PHI disclosure of information to a third party outside of HHS only occurs when an authorized iQIES user runs a report in the system where the contents include PII or PHI data. IQIES captures every execution of such reports in the iQIES database. 

The information stored in the iQIES database for each report execution includes the iQIES username, the report run, the report execution date, and other metadata about the report execution incident for tracking purposes. The user's address is linked to their iQIES username. 

Long Term Care Hospitals (LTCH) who submit patient assessments to iQIES are responsible for providing notice to patients. 

iQIES system users are notified that their PII is being collected by a system banner that is presented at login.

The original collectors (Private Sector) communicate directly with beneficiaries. 

Members of the public submitting a complaint against a provider or supplier have the option to remain anonymous. Perpetrators implicated in complaints do not have the option to object to the information collection because they are the subject of the complaint. 

There is no opt-out capability as login credentials (User ID and Password) are required to access iQIES.

The original collectors (providers and the private sector) communicate directly with beneficiaries.  A notice in the Federal Register would be made if major systems change occurred in iQIES.  

Login credentials (User ID and Password) are required to access iQIES.

For Customer PII:

Integrity – iQIES ensures data integrity by storing all PII within a transactional database layer that enforces rigid referential integrity. Data must meet strict validation requirements before being accepted into the system, ensuring its structural and relational integrity. Additionally, annual reviews are conducted to identify and resolve inconsistencies, such as duplicate PII/PHI data in patient-related tables and inconsistencies in Vendor/Provider tables.

Availability – iQIES database subsystems are continuously monitored to ensure data availability. Findings from these monitoring activities are reported to a logging dashboard, providing real-time oversight of system health. This continuous monitoring helps to maintain uninterrupted access to PII while proactively addressing potential system failures.

Accuracy – Accuracy of iQIES PII is enforced through application-level data submission validation rules. These rules ensure that data entered the system meets predefined criteria before being stored. Annual reviews further support accuracy by identifying incorrect or outdated information, including evaluating geographic data against known datasets.

Relevancy – To ensure iQIES PII remains relevant, periodic reviews assess whether stored data is still necessary and up to date. The review process involves checking data fields against authoritative sources and removing or updating information that is no longer relevant to system operations.

For User PII:

Integrity - User PII within the system is limited to first name, last name, email, and phone number. These data fields are stored in a transactional database layer with enforced referential integrity, ensuring that all records remain consistent and structured. The system prevents orphaned records and enforces unique constraints where applicable (e.g., unique emails for user accounts).

Availability - To ensure continuous availability of user PII, database subsystems are actively monitored, with real-time logging and reporting to a dashboard. In the event of system downtime or access issues, alerts are triggered for immediate resolution. Redundant backups and failover mechanisms further ensure that user data remains accessible when needed.

Accuracy – User PII accuracy is ensured through validation rules applied at the point of data entry (e.g., HARP). Upon iQIES system access, the HARP profile data copied into the local authentication database within iQIES, maintaining consistency and correctness.

Relevancy - Since user PII is minimal, its relevancy is primarily maintained through periodic audits. These audits verify whether user accounts remain active and whether the stored contact details are still valid. For inactive users, the system may flag records for review, prompting updates or removals based on retention policies.

• Users: Users may access PII authorized under the Data Use Agreement (DUA).
• Administrators: System Administrators may access PII to manage the system and troubleshoot potential issues. This is authorized by the DUA. 
• Developers: Developers may access PII to troubleshoot potential issues. Access is authorized under the DUA. 
• Contractors: Direct contractors authorized by CMS may access PII to conduct tasks under the assigned contract, authorized by the DUA.

System user access to PII is governed by assigning roles to the user account.  The process of assigning these privileges utilizes the principle of least privilege: users are only granted access based on their specific job responsibilities. To ensure the level of access is maintained for each of the roles, the role creation process involves analysis of the role definition and type of access granted by the role. 

Periodic account and access review ensures that system users are still authorized to view PII.

iQIES: CMS and Direct Contractors undergo annual Security Awareness Training (SAT) for general network and system access. Standard users (States, CMS partners, etc.) are not required to take SAT to use the iQIES system. CMS requires all employees and contractors with elevated or privileged access to undergo role-based training and general security training. Standard users (States, CMS partners, etc.) are not required to take SAT to use the iQIES system. However, all must be aware of Federal Security and Privacy standards and guidelines such as Health Insurance Portability and Accountability Act (HIPAA), Privacy Act of 1974, E-Government Act and the Federal Information Security Management Act (FISMA).

QTSO: CMS and Direct Contractors undergo annual Security Awareness Training (SAT) for general network and system access. Standard users (States, CMS partners, etc.) are not required to take SAT to use the QTSO system. CMS requires all employees and contractors with elevated or privileged access to undergo role-based training and general security training. Standard users (States, CMS partners, etc.) are not required to take SAT to use the QTSO system. However, all must be aware of Federal Security and Privacy standards and guidelines such as Health Insurance Portability and Accountability Act (HIPAA), Privacy Act of 1974, E-Government Act and the Federal Information Security Management Act (FISMA).

Based on role, selected iQIES Contractors and CMS personnel are provided with the following training in addition to general security and privacy awareness training:

Scaled Agile Framework (SAFe) Product Owner / Product Manager training SAFe Advanced Scrum Master training Certified Scrum Master training.

iQIES has a National Archives and Records Administration (NARA) Records Disposition Authorization, DAA-0440-2015-0009-0003, which states that records are destroyed when 10 years old, or when no longer needed for Agency business, whichever is later.

AWS follows the techniques detailed in Department of Defense (DoD) 5220.22-M (“National Industrial Security Program Operating Manual”) or National Institute of Standard Technology Special Publication (NIST SP) 800-88 (“Guidelines for Media Sanitization”) to destroy data as part of the decommissioning process.

iQIES:

Administrative: Only access necessary to perform respective job duties is granted.  Authentication and access control profiles are maintained.  Users may only view information and perform tasks according to pre-assigned security and access control profiles determined by the system administrator.

Technical: The following controls are in place to minimize the possibility of unauthorized access, use or dissemination of the data in the system: User Identification, passwords, firewall, Virtual Private Network (VPN), Encryption, and Intrusion Detection System (IDS).

Physical: The Data Center where information is stored uses Guards, ID badges, Key Cards, Cipher Locks, Biometrics and Closed Circuit TV to secure physical controls.

QTSO: Contains no PII, however QTSO follows the same control requirements as listed for iQIES.

iQIES: iQIES

QTSO: QTSO

• Session Cookies - Collects PII?: No