Measure Authoring Development integrated Environment

• Significant System Management Change
• New Public Access

The Measure Authoring Tool (MAT) is adding a new component to eventually replace the original MAT + Bonnie Tooling. The Measure Authoring Development Integrated Environment (MADiE) application will (eventually) provide the same functionality as the MAT and Bonnie applications. The MADiE Application uses the same PII data but strictly pulls from the Healthcare Quality Information System (HCQIS) Access, Roles and Profile Management System (HARP) system for PII elements. Only the first name, last name, telephone number and HARP ID are utilized in the system for user identification purposes required as a FISMA moderate system.

There has been no change to the types of information collected or stored.

Measure Authoring tool system is designed to allow electronic Clinical Quality Measure (eCQM) developers to compose electronic measures and export eCQMs in Health Quality Measures Format (HQMF), Human Readable, Clinical Quality Language (CQL), Expression Logical Model (ELM), and JSON file formats. Electronic measure creation and maintenance requires the use of Value Set information that will be provided through integration with the National Library of Medicine (NLM) Value Set Authority Center (VSAC).  The MAT tool is also integrated with the Bonnie testing tool developed by MITRE to test eCQMs.
 
The objective of the Measure Authoring Tool system, (MAT) is to become the standard under which electronic measures are built and are defined for use in other governmental and non-governmental systems. The MAT system is an open source project and is maintained in partnership with members of the measure development community which consists of Center for Medicare and Medicaid Services (CMS), Healthcare Information System (HSIS), Value Set Authority Center (VSAC), Enterprise Science and Computing (EASC), and The MITRE Corporation.

The MADiE application is a modernization effort to replace the functionality of the legacy applications (MAT and Bonnie Apps). This will bring new development principles and technologies, improving performance and functionality, while continuing to support the same mission and purpose of the legacy applications. The MADiE application will continue utilize the same partners and data providers to support the needs of the eCQM community.

• Name
• E-Mail Address
• Phone Numbers
• Other - HARP User ID

• Employees
• Public Citizens
• Business Partners/Contacts (Federal, state, local agencies)

• Online
• Email

The collection and use of PII in the Measure Authoring Tool and Bonnie only pertains to users of the system and is required for the purposes of account registration and management. Therefore, there is no option for users to opt-out of the collection of their user ID and password as it is necessary to perform their job. Use of the Measure Authoring Tool is voluntary.

The privacy policy includes a link to http://www.usa.gov/optout-instructions.shtml, which provides instructions on blocking cookies. 

As PII is related to accounts for registered users, PII is checked for accuracy as part of quarterly account audits.

E-mail bounce back messages trigger a review of relevant accounts.

MAT system maintainers have implemented both unique and regular indexes to support data integrity and prompt data retrieval. Data is encrypted at rest, which supports data integrity. Data access is limited to system administrators and end users with authorized access. Logs are maintained to track any changes made to data that include who modified a particular file and when those changes were made. The data sets used by the MAT are under the purview of the CMS Data Integrity Board. 

• Users: For purpose of sharing measure definitions with other users.
• Administrators: For purpose of administering accounts of registered users and for issuing email notifications.

Account registration and corresponding accounts for the measure authoring community are retained in accordance with General Records Schedule (GRS) 3.2 Information Technology and Management Records DAA-GRS-2013-0006-0003, "Destroy 1 year(s) after user account is terminated or password is altered or when no longer needed for investigative or security purposes, whichever is appropriate."

System audit logs retained in accordance with General Records Schedule, Electronic Records GRS GRS 4.3, item 020, "Delete/destroy when the agency determines they are no longer needed for administrative, legal, audit, or other operational purposes."

Retention policies are in line with the NARA guidelines outlined in N1-GRS-03-1 which states, "Destroy/delete when 5 years old or 1 year after responsible office determines that there are no unresolved issues, whichever is longer. (N1-GRS-03-1 item 1a)."

Data destruction policies follow NIST guidelines provided in NIST Special Publication 800-88 Revision 1, Guidelines for Media Sanitization.

Electronic records such as passwords are cleared from the system when changed. End of life hard drives and paper records are destroyed via a certified and bonded shred company.

Electronic records are purged.  Paper records are destroyed via a certified shred company.

Technical controls include but are not limited to: 
Authorized users: Unique identification and password authentication for access Measure Authoring Tool.
Separation of duties, filters and parameters are set up in accordance with an approved configuration to enforce the security policy.
 
Destruction of electronic information, as appropriate, via sanitization of the systems holding the information.
Audit of events initiated by each individual user, i.e., entry of UserID and password, program initiation, file creation, file deletion, file open, file close, and other user related actions,
Audit trails identify the individual user initiating the event, date, and time the event occurred, success, or failure of each event, and location where the event was initiated,

Security training and ongoing awareness programs, such as posters and newsletters. 
Access controls, including termination procedures to ensure only authorized personnel have access to facilities and systems, commensurate with their job duties.
Review of system activity logs to monitor for issues, Risk Management plans to include Risk assessments, Security Plans, Continuity of Operations/Disaster Recovery plans.
Background and reference checks are performed on all HCIS personnel. 

https://www.emeasuretool.cms.gov

https://bonnie.healthit.gov/

https://bonnie-fhir.healthit.gov/

https://bonnie-prior.healthit.gov/

https://madie.cms.gov (TBD)

• Session Cookies
• Persistent Cookies