Open Payments System

As required by the Open Payments provisions that were included in the Patient Protection and Affordable Care Act (ACA) the Open Payments System allows for applicable manufacturers and applicable Group Purchasing Organizations (GPOs) to annually report payments and other transfers of value made to Physicians and Teaching Hospitals (THs), including certain information regarding the ownership or investment interests held by Physicians or their immediate family members. CMS is required to compile the submitted data and publish it on a public website.

The Open Payments System has undergone the following changes since the last Privacy Impact Assessment (PIA) was conducted:

A new Portlet titled "CMS Compliance Portal" was added within the Open Payments project folders. The new portlet contains functionality for the CMS Compliance Team to meet requirements for the Open Payments program.

An enhancement was added to provide teaching hospitals a utility to search for a physician's Open Payments Profile ID by the National Provider Identifier (NPI). The new functionality allows for teaching hospitals to upload a list of NPIs to Open Payments, and Open Payments will return the list of Open Payments IDs that can be used to verify against the publication.

An enhancement was added to store emails/notifications generated by the system so that all user types can view messages sent to them in the last 365 days. The Messages landing page allows users to filter and sort the list of emails sent to their organization.

An enhancement was added to automate the manual process of merging multiple Open Payments user profiles automatically. Creating two different Profile IDs for the same Physician is a known system behavior that has to do with the order in which the Physician information is received by the Open Payments System. 

Based on these changes no new Personally Identifiable Information (PII) data has been collected, maintained, or stored by the Open Payments System.

As part of the Affordable Care Act (ACA), the Centers for Medicare & Medicaid Services (CMS) Open Payments System (OPS) was created to provide a repository of information about the financial relationships between physicians and teaching hospitals with pharmaceutical and medical device manufacturers (applicable manufacturers) and Group Purchasing Organizations (GPO).

Applicable manufacturers and GPO that participate in U.S. federal health care programs are required to report certain payments (monetary and non-monetary) made to physicians and teaching hospitals. They must also report any ownership or investment interest that physicians, or their immediate family members, have in their company. These payments may include consulting fees, research grants, entertainment and travel reimbursements, and payments made from the industry to medical practitioners.

OPS collects information about physicians such as their name, medical practice information, Job Title, and Employee Identification Number (EIN), business address, email address, primary practice address (if outside the United States), business phone number, state medical license, National Provider Identifier (NPI) and nature of payments received.

The nature of payment categories are as follows: consulting fees; compensation for services other than consulting, including serving as faculty or as a speaker at an event other than a continuing education program; gifts or vacations; entertainment, like tickets to events; food and drinks; travel and lodging; educational expenses, including textbooks and continuing medical education courses; research activities; and ownership and investment interests in medical manufacturers or Group Purchasing Organization (GPO).

OPS collects information about teaching hospitals that receive compensation from manufacturers and GPO such as hospital name, address, a designated contact person’s name, business email and telephone and types of payments. Types of payments are grants and space rental/facility rental fees.

OPS has business information about the manufacturing companies and GPO that report into the system such as business name, address, and contact person(s) telephone and email.

To access OPS, a user must first register and log into the CMS Identity Management (IDM) web portal each time they wish to use OPS. IDM is the access control portal and is where user credentials are collected, stored, and maintained. Then the user creates a user ID and password to access OPS while in the IDM portal.

The "users" include Physician, Physician's Authorized Representative, Teaching Hospital authorized officials, Teaching Hospital authorized representatives, Applicable Manufacturers and Applicable GPOs, Principal Investigators, and Contractors (Database Administrators (DBA), Developers, Help Desk, Business Analyst (BA) Team, and Testing Team).

The Open Payment System (OPS) is a national disclosure program that promotes transparency on the financial relationships between the healthcare industry, Applicable Manufacturers (AM) and Group Purchasing Organizations (GPO), and healthcare providers, individual physicians, and teaching hospitals. The OPS program information is publicly available on CMS' website, Open Payments Program.

The information collected through OPS from applicable manufacturers and GPOs is the company profile information to identify them as participants in the program. The information collected about physicians such as name, practice type, Job Title, EIN, business address, telephone and email, and the nature, context, and amount of payment. In addition, NPI and Medical License number is provided by the physicians. When registering in the Open Payments system, physicians must enter all of the state license numbers they hold, as well as their NPI number (if they have one). The Job Title is provided during entity user profile creation. The EIN is provided during entity profile creation. For teaching hospitals, the information is the name of the hospital, the physician involved and the address, telephone and contact for the hospital, along with the nature, context and number of payments.

The nature of payments includes direct monetary payments and various non-monetary payments: compensation for services other than consulting, including serving as faculty or as a speaker at an event other than a continuing education program; gifts or vacations; entertainment, like tickets to events; food and drinks; travel and lodging; educational expenses, including textbooks and continuing medical education courses; research activities; and ownership and investment interests in medical manufacturers or GPO.

OPS user credentials are collected and maintained by the Identity Management (IDM). IDM is external to OPS and the PII within IDM is covered by a separate PIA. After initial log into the IDM system, a user inputs a user ID and password to gain access to OPS. Only the OPS end users' IDM user ID is stored in Open Payments. The "users" include Physician, Physician's Authorized Representative, Teaching Hospital authorized officials, Teaching Hospital authorized representatives, Applicable Manufacturers and Applicable GPOs, Principal Investigators, and Contractors (DBA, Developers, Help Desk, BA Team, and Testing Team).

The Open Payments System regularly uses PII to retrieve system records including using the first name, middle name, last name, IDM User ID, email address, phone number, physician NPI, and Physician License and License State about Physicians, Physician's Authorized Representative, Teaching Hospital authorized officials, Teaching Hospital authorized representatives, Applicable Manufacturers and Applicable GPOs, Principal Investigators, and Contractors (DBA, Developers, Help Desk, BA Team, and Testing Team).

• Name
• E-Mail Address
• Phone Numbers
• Mailing Address
• Other - Job Title, Business Name, Business Address, Business Email, Business Phone Number, Physician License State and License Number(s), Primary practice address (if outside the United States), state medical license, National Provider Identifier (NPI), Employer Identification Number (EIN) and user credentials (user ID and password)

• Employees
• Public Citizens
• Vendors/Suppliers/Contractors
• Other - Teaching Hospitals

• In-person
• Online

• Within the OPDIV

• Members of the Public
• Private Sector

When an individual creates a new user account in IDM, there is a "Consent to Monitoring & Collection of Personally-Identifiable Information (PII)" introduction displayed on the Terms & Conditions page. The person can elect to "Decline" to accept the Terms and Conditions and then no account will be created. 

Then, each time a user accesses the login section of IDM, to access to OPS, there is a Terms and Conditions statement that the user must click the "I Agree" button to move forward. It states that their personal information is being collected.

The redress process in place to resolve a user's concerns when they believe their PII has been inappropriately obtained, used, or disclosed, or that the PII is inaccurate is for the user to contact the Help Desk via phone or email. Depending on the issue, the trouble ticket could be created by CMS IT Service Desk or the Open Payments Help Desk.

If it is a security incident, then the Help Desk, application team & infrastructure team work together to investigate further, identify a fix, and ensure it is implemented/resolved.
If it is not a security incident, say, just the mailing address disclosed is incorrect, then the users can update the profile information themselves on the CMS Portal.

For the OPS program participants such as applicable manufacturers, GPOs, teaching hospitals, the users update their own PII within the system. For example, if the physician's PII record within the OP application is inaccurate, the physician uses the Review and Dispute functionality of the OP application to get it corrected. The applicable manufacturer or GPO that created the record reviews the disputed information and works with physicians or teaching hospitals to review and correct or update any disputed information. The dispute resolution is captured within the OPS and the information is updated.

Any incorrect data is corrected by the users themselves while using the system, by updating whichever element is incorrect in their profile, like a name change or new telephone.

The integrity of PII is managed by firewalls and encryption layers. Full-device encryption is employed to protect the confidentiality and integrity of information on approved mobile devices.

Throughout the year, the OPS allows the applicable manufacturers and GPOs to submit payment information via bulk file uploads. The physicians included in those reports can review and dispute any incorrect information about themselves.

The dispute and resolution functions of the OPS system maintains the relevancy of PII in the system.

For the user credentials, the OPS system administrators are responsible for maintaining the allowable/registered users by deleting, reactivating or confirming the user accounts. There are processes in place to review the current users between IDM and OPS and eliminate any inactive accounts.

For the OPS program participants such as applicable manufacturers, GPOs, teaching hospitals, the users update their own PII within the system. For example, if the physician's PII record within the OP application is inaccurate, the physician uses the Review and Dispute functionality of the OP application to get it corrected. The applicable manufacturer or GPO that created the record reviews the disputed information and works with physicians or teaching hospitals to review and correct or update any disputed information. The dispute resolution is captured within the OPS and the information is updated.

• Users: The users who have access to PII are the AM/GPO and the physicians. The AM/GPO access is needed so they can upload information relating to physicians & teaching hospitals into the OPS as part of their function.  The physicians and teaching hospitals have access only to their own information in reports generated by the system.  Such access is needed so they can verify the accuracy of the information reported.
• Administrators: Authorized users such as Administrators are provided with a minimum necessary system access for the performance of required tasks. Administrators do not normally have access to PII but may need incidental access for the performance of some tasks.
• Developers: Authorized users such as Developers are provided with a minimum necessary system access to perform system maintenance. Developers do not typically have access to PII but may need incidental access for the performance of some tasks.
• Contractors: Authorized users such as Direct Contractors in their roles as Administrators and Developers may have access to PII in those roles to perform job functions.

OPS contains both Financial and Provider/Health Plan records and is covered by the following records retention schedules:

Bucket 3, Financial Records, Financial Records (Programmatic) falls under DAA -0440-2015-004-001 and has a Temporary retention which is to Destroy no sooner than 7 years after cutoff but longer retention is authorized.

Bucket 6, Provider and Health Plan Records, falls under DAA-GRS-2013-005-003 which has a Temporary retention which is to Destroy no sooner than 7 years after cutoff but longer retention is authorized.

GRS 3.1, Item 51 General Technology Management Records. Data administration records. All documentation for temporary electronic records and documentation not necessary for preservation of permanent records, fall under DAA-GRS-2013-005-0003. These records have a Temporary retention of 5 years.

PII will be secured in the system using these administrative, technical, and physical controls. The administrative controls include inactivity timeout, more than one method of authentication required to verify user's identity, annual account reviews, and user trainings.

OPS is part of a CMS Data Center, and the access is controlled by cameras, biometrics readers and badge readers.  Also, personnel who no longer require authorization are promptly removed from all access lists. 

The technical controls include firewalls to prevent unauthorized system access, encrypted access when users obtain the IDM authentication (approval) to log into the application and a tiered system architecture which means users can only log into the application but not into any test environment and the testing and active applications are not joined together.

• Session Cookies - Collects PII?: No