Maryland Primary Care Program System

The types of information collected, maintained, or disseminated through the MDPCP System include: 

Demographic information and various Practice and CTO contacts

Practice information including organizational details including MDPCP practice ID number, and Tax ID Number (TIN)

CTO information including organizational details and TIN

Beneficiary information including name, date of birth, and Medicare Beneficiary Identifier (MBI).

Health Information Technology (IT) information including Vendor Roster that contains Name, CMS Electronic Health Record (EHR) Certification ID, Phone Number and Email

Composition information including Practitioner Roster which has Name, National Provider Identifier (NPI) and Email

Composition information including Staff Roster collected are Name and Email

Participation Agreement Documents

Letters of Support Documents

Practice Reporting information on a daily and monthly basis

CTO Reporting information on a daily and monthly basis

MDPCP processes the following PII elements:
Name
E-Mail Address
Phone Numbers
Taxpayer ID
Date of Birth
Mailing Address
Medical Records Number
Other - Other - NPI, Medicare Beneficiary Identifier (MBI), Sex, Age, Race, Date of Death, Enterprise Identity Data Management (EIDM) User ID, Practice Name, Maryland Board of Physicians License Number, and MDPCP practice ID number.

MDPCP will collect Practice reporting information that CTOs will attest to on a quarterly basis. This reporting is a status of the participating practices’ progress towards meeting the goals of the initiative. These goals are monitored by CMS, supporting contractors, and participating payers. MDPCP provides participating practices with tools to assist with their reporting such as the ability to download supporting reports essential to their success in this initiative. The CMMI, participating payers and contractors supporting the initiative use MDPCP to monitor the progress and compliance of participating practices. 

MDPCP maintains demographic information and organization information about the participating MDPCP practices and CTOs, as well as the demographic information of points of contacts and participating providers. This information is necessary for model operations and serves as a single point of reference for practices, CTOs and other MDPCP stakeholders. MDPCP Practices, CTOs, and participating payers receive information on a routine basis to support their work in the model. For Practices and CTOs, these include Payment and Attribution, Beneficiary Attribution Reports, other Administrative documents such as Participation Agreements and Letters of Support. Participating payers also receive their Provider Roster reports through MDPC. This is critical information for payer operations because it determines the providers in MDPCP who are to receive care management fees. 

Login credentials are provided by CMS's enterprise identity management system and used to grant access to the system. MDPCP is accessible only to stakeholders involved in the model and is a vehicle with which CMS is able to securely provide information to and collect information from stakeholders.

MDPCP users use PII to retrieve system records including using the name, or NPI. Admin users have the ability to search with user id information and MDPCP practice ID number.

• Name
• E-Mail Address
• Phone Numbers
• Taxpayer ID
• Date of Birth
• Mailing Address
• Medical Records Number
• Other - Other - NPI, Medicare Beneficiary Identifier (MBI), Sex, Age, Race, Date of Death, Enterprise Identity Data Management (EIDM) User ID, Practice Name, Maryland Board of Physicians License Number, and MDPCP practice ID number.

• Employees
• Business Partners/Contacts (Federal, state, local agencies)
• Patients
• Other - MDPCP Model participating Practices and CTOs

Demographic information of MDPCP practice sites, CTOs, participating providers, and practice information are used to determine eligibility and beneficiary attribution/alignment (the process of using Medicare claims data to associate beneficiaries with clinicians providing their care).

Beneficiary information is shared with MDPCP practices to verify beneficiaries, understand from whom they are receiving care management fees, and implement all the five functions of MDPCP care delivery transformation.

Practice and CTO Point of Contact (POC) information is collected to enable CMS to have a communication point of contact for each participating practice and CTO in MDPCP.

Collected information is also used to populate reports such as the Beneficiary Attribution, Practice Roster and CTO Roster reports. These reports are securely provided to the Operations contractor for uploading to MDPCP. MDPCP users associated with certain roles are only permitted to download reports applicable to their roles and practice association.

• Online
• Other - CTOs provide their contact information online.

Not applicable. Notice is the responsibility of the providers. 

The information that is submitted is sourced from existing medical records that have already been collected by the provider. Responsibility for patient notification resides at the point of information collection from the individual. However, all Medicare participants are provided with a CMS Notice of Privacy Practice that states that although they can elect to not share data for certain processes, as a condition of participating in Medicare, their information will be shared for certain purposes, such as quality assessment and reporting.

MDPCP end-users are given Terms and Conditions during the CMS account registration process which include Consent to Monitoring, Protecting Your Privacy, and Consent to Collection of Personal Identifiable Information (PII).

It is the responsibility of the providers to provide individuals with an option to opt out. 

The provision of PII is "voluntary" as that term is used by the Privacy Act. However, in order to receive benefits under the Medicare program, individuals must provide PII including all of the information collected and used by MDPCP.

Beneficiaries are provided with a Letter from their provider that include instructions on how to opt out of and manage their data sharing preferences.

MDPCP users must provide PII in order for system administrators to authenticate their identity and provide them with access to MDPCP.

Changes to MDPCP that involve uses and disclosures of beneficiaries' PII or authentication information are not expected to occur. In the event that such changes were to occur, CMS informs beneficiaries using multiple channels, including direct mailings; notices on the CMS web site (including edits to CMS's posted Privacy Policy), or changes to the relevant Systems of Records notices.

In the event of changes involving uses and disclosures of authentication information, employees will be notified by notices on the CMS Intranet; newsletters; updates to the relevant Systems of Records notices; E-mails to affected individuals; and through supervisors and system owners.

CTO POCs review their CTO information, Practice POCs review their practice information and beneficiary information at least quarterly to ensure the data’s accuracy and relevancy.

Data availability and integrity is protected by security controls selected as appropriate. MDPCP follows the CMS Security and Privacy program and complies with the CMS Acceptable Risk Safeguards, and National Institute of Standards & Technology (NIST) documents such as its Special Publications to select controls appropriate to the level of risk of the system, determined using NIST's Federal Information Processing Standard 199.

• Users: Practice, Support, CMMI, CTO, Admin, and learning and diffusion (L&D) users access the MDPCP Application to perform the respective duties as outlined by the Program.
• Administrators: Database administrators (DBA) provide maintenance for the system. Administrators include direct contractors.
• Developers: Application Development Organization (ADO) direct contractors provide maintenance support including Post PROD testing, File ingestion and verification, and Troubleshooting PROD issues.
• Contractors: Direct contractors provide implementation and Application Support.

Role-based access is utilized to ensure users have access to only what is necessary to perform duties related to their specific role/function with MDPCP. Access to MDPCP System PII is determined by user role type, associated CTO(s) and associated practice(s). Roles and access capabilities are defined in the system’s Operations and Maintenance Manual and approved by the MDPCP Business owner.

System Administrators review user accounts at least semi-annually. Any anomalies are addressed and resolved by contacting the user, or by removing their access if no longer required. Activities of all users are logged and reviewed by the system administrator to identify abnormal activities, and if any are found they are reported to the business owner, and the Information Systems Security Officer (ISSO).
Development Contractor conducts smoke testing following each production deployment to ensure the applications features and functions are operational.

The application adheres to data retention and destruction policies/procedures that follow National Archives and Record Administration (NARA) guidelines related to data retention and NIST guidelines related to data destruction. More specifically, MDPCP adheres to the following NARA general records schedule guidelines:

Beneficiary RecordsDAA-0440-2015-0007-0001; Destroy no sooner than 10 year(s) after cutoff but longer retention is authorized

Provider and Health Plan RecordsDAA-0440-2015- 0008-0001; Destroy no sooner than 7 year(s) after cutoff but longer retention is authorized

To secure PII, MDPCP follows, and the direct contractor is bound by contract to follow, the CMS Security and Privacy program and complies with the CMS Acceptable Risk Safeguards which are aligned to HHS policies and to NIST requirements.

Access to the system is given based on need to know and job responsibilities. System maintainers use security software and methods to provide role-based “least privilege access.” MDPCP System Users utilize their individual user id and password to access the MDPCP System. Users are required to agree to the Terms and Conditions within the CMS Computer Systems Security Requirements, which contains HHS’s Rules of Behavior. System activity logs are reviewed to monitor the system and user activities for issues. Controls used include:

Administrative: The MDPCP System uses the principle of least privilege as well as a role-based access control to ensure system administrators, and users are granted access on a "need-to-know" and "need- to- access" commensurate with their assigned duties. Users must receive manager approval to gain access to the system. 

Technical: The data in MDPCP is secured behind a firewall and through application security. Technical security controls include but are not limited to virtual private networks (VPN), intrusion detection systems (IDS), user accounts, passwords, and access limitation.

Physical: The data center site is secured with guards, identification badges, key cards, locks and closed-circuit televisions.