QNET Enterprise Services

QNET ES comprises of multiple application services supporting various Health Care Quality Information System (HCQIS) functions. The functions supported by each application service are provided below.

HCQIS Access, Roles and Profile Management System (HARP) is the QualityNet Identity Management (IDM) system for the CMS Center for Clinical Standards & Quality (CCSQ) user community. The system is comprised of three components: Okta, Saviynt and Common UI. HARP assigns, controls, tracks, and reports authorized access to and use of Centers for Medicare & Medicaid Services (CMS), computerized information and resources, across multiple CMS systems and business contexts.

Unified File Management (UFM) is an application for the CMS QualityNet community to securely transfer data files over the internet using GoAnywhere Managed File Transfer. GoAnywhere is a commercial-off-the-shelf (COTS) product. UFM provides the capabilities for transferring data files from person-to-person(s) using UFM Secure Mail or from person-to-system through UFM Secure Forms.

QualityNet Portal (QNP)/QualityNet is a public-facing website located at QualityNet. It is used to provide healthcare quality improvement news, resources, and data reporting tools used by healthcare providers in support of select CMS quality reporting programs. In addition, QNP consists of QualityNet Mailer (list serve) and Program Resource Repository (PRS 2.0).

CCSQ QualityNet Slack is a software-as-a-service (SaaS) digital communication platform that allows users to message and collaborate with individuals, and groups within the CCSQ Community. Modes of communication and collaboration include channels, direct messaging, voice calls, screen share, and file sharing.

QualityNet Atlassian is a collection of collaboration and planning application services available to CMS, CMS contractors, and CMS stakeholders. The Atlassian suite includes the following tools:

QualityNet Jira: A work management system used by software development and Agile teams to create, manage, and track tasks and workflows. 

QualityNet Confluence: A group collaboration and document management tool used for storing documents and content publication for CMS audience.

QualityNet SurveyMonkey is a survey tool used for creating, tracking, and analyzing survey responses.

TestRail is used for planning, organizing, executing, and reporting on testing activities in support of application development organizations (ADOs) within the HCQIS environment. It provides capabilities for tracking and recording testing progress at multiple levels of the software development life cycles.

Udacity: is an online learning tool that provides curriculum based on various subject areas in Information Technology, Business, etc.

Splunk is a SIEM tool for searching and exploring data. It can help predict, identify, and solve problems related to business, information technology (IT), DevOps, and security in real time. Splunk is an advanced and scalable form of software that indexes and searches for log files within a system and analyzes data for operational intelligence. The software is responsible for capturing, correlating, and indexing real-time data, from which it creates alerts, dashboards, graphs, reports, and visualizations. This helps CMS QualityNet recognize common data patterns, diagnose potential problems, apply intelligence to business operations, and produce metrics.

HARP collects, maintains, and stores Full Name, Address, Phone Number, E-mail Address, and User ID credentials of CMS Employees, Public Citizens, Business Partners/Contacts (Federal, State, Local Agencies), and Vendors/Suppliers/Contractors. It also collects the last 4 digits of the Social Security Number (SSN) via the Office of Information Technology (OIT) instance of Okta for remote identity proofing. In addition to user information, HARP collects and maintains information about Quality Program applications, associated organizations, application roles, user profile management, and associated Security Officers that provide user administration and access approval activities. User profile attributes are not purged from the system. Roles and Organizations are removed if the organization is offboarded.

UFM stores user account information including First Name, Last Name, Email Address, and Phone Number in local GoAnywhere Accounts. Disabled or inactive UFM accounts are not purged from the system. 

The UFM system does not open or read the data file content or validate any of the file content of the data files. All files are encrypted in transit and at rest. Data files transferred may contain PII/PHI information. The data files are scanned using anti-virus software. File transmission information is used to track files submission for data upload.

QNP/QualityNet collects, maintains, and shares content from the user community and made available for public consumption on the website. It also collects usernames and roles. The collected contents are stored if they remain relevant and valid to the program. Public forms like the Alzheimer’s Disease CED Study Registry collect MBI. PRS collects and shares Beneficiary information including Full Name, Medicare Beneficiary Identifier (MBI), Health Care Insurance Claim Number (HICN), Claim Account Number (CAN), last 4 digits of SSN, Date of Birth, Address, Coverage information, Sex, Primary Payer Code, Railroad Retirement Board (RRB), Taxpayer ID, Medical Records Number, and Telephone Number. 

CCSQ QualityNet Slack collects and stores collaboration data from CCSQ users, contractors, and CMS users in Channels, Direct Messaging, File Sharing, and data shared with Slack from other QualityNet applications using Slack plug-ins. Slack also collects and stores user data including Name, User ID credentials, and email address. The user credentials are created in HARP. Slack retains user data for 13 months or until explicitly removed by the user or admin before that.

QualityNet Atlassian:

QualityNet Confluence acts as a data repository for the CCSQ community to collect, maintain, and share data on its public facing pages. The data stored in Confluence includes CMS specific project data, collaboration data for CCSQ contractors, file uploads, provider data, and user data including PII/PHI. Confluence also stores user credential data including Name, User ID, and Email. User credentials are created in HARP. The collected user data is stored if it remains relevant and valid to the program. User generated information is stored until it is explicitly removed by the user or an admin.

QualityNet Jira is an Agile workflow management application for the CCSQ community which collects and maintains CMS specific project data, collaboration data for CCSQ contractors, file uploads, provider data, and user data including PII/PHI. Jira also stores user credential data including Name, User ID, and Email. User credentials are created in HARP. The collected user data is stored if it remains relevant and valid to the program. User generated information is stored until it is explicitly removed by the user or an admin.

QualityNet SurveyMonkey collects, maintains, and shares survey data from CCSQ users. The surveys do not contain any PII/PHI information. SurveyMonkey also stores username, first name, last name, and email information for CCSQ users. User credentials are created in HARP. The collected user data is stored if it remains relevant and valid to the program. User generated survey data is stored until it is explicitly removed by the user or an admin.

TestRail does not collect, maintain, or share information including PII.

Udacity stores username, first name, last name, and email information of CCSQ users. User credentials are created in HARP.

Splunk collects application and operating system logs. Splunk also stores username and email address of the Splunk users. CCSQ contractors are responsible for not forwarding sensitive information like PII or PHI to Splunk.

HARP collects Full Name, Address, Phone Number, Date of Birth (DoB), phone number, SSN (last 4 digits), E-mail Address, and User ID credentials of CMS Employees, Public Citizens, Business Partners/Contacts (Federal, State, Local Agencies), and Vendors/Suppliers/Direct Contractors. This information is used for remote identity proofing. In addition, the Help Desk use PII daily to verify user identity when addressing account access issues.  

UFM system utilizes the GoAnywhere Commercial-off-the-Shelf (COTS) product for the secure transfer of community user data. The GoAnywhere COTS product stores a local user account for user authentication. The GoAnywhere local accounts include the following information: HARP user identifier, first name, last name, phone number, organization of employees. The personal identifiers are used daily to maintain permissions and access between UFM and HARP applications, and for resolving user accounts access issues. Data files transferred may contain encrypted PII/PHI information.

QNP/QualityNet is a public facing website. It utilizes HARP user identifier, first name, last name, phone number, organization of employees. HARP collects, stores, and maintain the collected information. Within QNP, PRS collects and shares Beneficiary information including Full Name, Medicare Beneficiary Identifier (MBI), Health Care Insurance Claim Number (HICN), Claim Account Number (CAN), last 4 digits of SSN, Date of Birth, Address, Coverage information, Sex, Primary Payer Code, Primary Payer Code, Railroad Retirement Board (RRB) identifier, Taxpayer ID, Medical Records Number, and Telephone Number.

CCSQ QualityNet Slack collects and stores data from CCSQ users via Channels, direct messaging, file share, and voice/video call functionality. Slack also stores user data including Name, user ID, and email within its SaaS cloud. Information is stored in Slack to facilitate collaboration between CCSQ user community.

QualityNet Atlassian:

QualityNet Confluence acts as a data repository for the CCSQ community and it’s intended to securely store CMS specific project data, collaboration data for CCSQ direct contractors, file uploads, provider data, and user data including PII/PHI. Confluence also stores Name, HARP ID, email, HCQIS Active Directory ID for CCSQ users. Information is stored in Confluence to facilitate collaboration between CCSQ user community.

QualityNet Jira acts as an Agile workflow management tool for the CCSQ community and it’s intended to securely store CMS specific project data, collaboration data for CCSQ direct contractors, file uploads, provider data, and user data including PII/PHI. Jira also stores Name, HARP ID, email, HCQIS Active Directory ID for CCSQ users. Information is stored in Jira to facilitate collaboration between CCSQ user community.

QualityNet SurveyMonkey collects, maintains, and shares survey data from CCSQ users. The surveys do not contain any PII/PHI information. SurveyMonkey also stores username, first name, last name, and email information for CCSQ users. Information is stored in SurveyMonkey to enable survey functionality for the CCSQ user community.

TestRail does not collect, maintain, or share information including PII. It is used for tracking and recording testing progress at multiple levels of the software development life cycles.

Udacity stores username, first name, last name, and email information for CCSQ users.

Splunk stores username and email information for user account management purposes.

• Social Security Number
• Name
• E-Mail Address
• Phone Numbers
• Medical Notes
• Taxpayer ID
• Date of Birth
• Mailing Address
• Medical Records Number
• Other - QNP/QualityNet: User ID/Passwords and Roles, Medicare Beneficiary Identifier (MBI), Health Care Insurance Claim Number (HICN), Claim Account Number (CAN), Coverage information, Sex, Primary Payer Code, Railroad Retirement Board (RRB), organization of employees. HARP: full name, address, phone number, and user ID credentials. UFM: The PII uploaded by user community is determined by the Line of Business user community. The UFM application does not open or read the content of the data file.

• Employees
• Public Citizens
• Business Partners/Contacts (Federal, state, local agencies)
• Vendors/Suppliers/Contractors
• Patients
• Other - QNP/QualityNet: Employees, UFM: Employees, HARP: CMS Employees, Public Citizens, Business Partners/Contacts (Federal, State, Local Agencies), Vendors/Suppliers/Direct Contractors, and CCSQ QualityNet Slack/QualityNet SurveyMonkey/Atlassian: CCSQ users.

HARP: Full name, address, phone number, email address data of birth and user ID credentials are used to verify the identity of CMS Quality Program users.

UFM: UFM stores the UFM users first name, last name, email address, and phone number in local GoAnywhere Accounts for account management. UFM User IDs are used for identity management purposes. UFM does not read, update, or validate the information contained within the end user data files as processing the data files is the responsibility of the end user. Data files transferred may contain PII/PHI.

QNP/QualityNet: User ID and Password are used to configure access to the Web Content Manager. The Alzheimer’s Disease CED Study Registry collects MBI for claims requests. PRS Health Service provider and Beneficiary PII/PHI elements are used to look up information regarding HSP and/or Beneficiaries.

CCSQ QualityNet Slack/QualityNet SurveyMonkey/Atlassian: Full name, User ID credentials, and email information for CCSQ users is stored for user management, auditing, and incident response functions performed by application admins and security personnel.

QualityNet Atlassian (Confluence and Jira) may also store user generated/uploaded PII/PHI information to enable collaboration between project teams or to provide a secure storage for the information.

TestRail: N/A – No PII collected/used by the system.

Udacity: Full name and email information for CCSQ users is stored for user management, auditing, and incident response functions performed by application admins and security personnel.

Splunk: Username and email information for CCSQ users are stored for user management, auditing, and incident response functions performed by application admins and security personnel.

SSN is used for identity proofing of user prior to access to the HARP system. SSN is collected during registration of new user account. They are collected and stored in Saviynt. Only the last four (4) digits are stored in HARP.

HARP collects SSN and sends it to Experian for remote identity proofing. Experian is third-party identity verification service provider.

Authority for maintenance of the system is given under Executive Order 9397, the Debt Collection Improvement Act, 31 United States Code (U.S.C.) § 7701(c)(1), and 5 U.S.C. 552a(b)(1), and 301.

The statutory authority is described in the provisions of sections 226A, 1875, and 1881 of the Social Security Act (Title 42 United States Code (U.S.C.), sections 426-1, 1395ll, and 1395rr).

09-70-0538 – Individuals Authorized Access to Centers for Medicare & Medicaid Services (CMS) Computer Services (IACS).

ASPEN Complaints/Incidents Tracking System (ACTS) 09-70-0565

Hospice Item Set (HIS) 09-70-0548

Inpatient Rehabilitation Facilities – Patient Assessment Instrument (IRF-PAI) 09-70-0521

Long Term Care Hospitals Quality Reporting Program (LTCH QRP) 09-70-0539

Long Term Care Minimum Data Set (LTCMDS) 09-70-0528

HHA Outcome and Assessment Information Set (OASIS) 09-70-0522

Provider Enrollment, Chain, and Ownership System (PECOS) 09-70-0532

Medicare Beneficiary Database (MBD) 09-70-0536

• In-person
• Online
• Other - Non-Government Sources – Private sector

• Within the OPDIV
• State/Local/Tribal

• Members of the Public
• Private Sector

Individuals with concerns about PII collection and disclosure should follow the QualityNet Incident Response Procedures and contact the QualityNet Service Desk.

QualityNet Service Desk
Phone: 1-866-288-8912 (TRS 711)
TTY: 877-715-6222
E-Mail: QNET Support Email

The QualityNet Service Desk generates security incident tickets and assigns them to the appropriate team.

• Administrators:
  • UFM - UFM Administrator users need access to the user account information such as first name, last name, email address to review valid user accounts.
  • QNP/QualityNet: PII in the QNP content management system consists of username and password. No one will have access to a user’s password. Usernames will be visible to the QNP administrator (general, site, or content administrators) who are responsible for administering roles and access to the site and must be able to access user accounts to add or remove user access privileges.
  • CCSQ QualityNet Slack/QualityNet SurveyMonkey/Atlassian: Full name, User ID credentials, and email information for CCSQ users is stored for user management, auditing, and incident response functions performed by application admins and security personnel. For QualityNet Atlassian, Admin users do not require access to the data files which may contain PII/PHI uploaded by application users.
  • Udacity: Full name and email information for CCSQ users is stored for user management, auditing, and incident response functions performed by application admins and security personnel.
  • Splunk: Username and email information for CCSQ users are stored for user management, auditing, and incident response functions performed by application admins and security personnel.
• Contractors:
  • HARP: CMS direct contractors with the approved HARP Security Official (SO) role have access to PII within the Security Official component of HARP which allows them to approve user role requests for each application. As a safeguard, users’ activities are logged and stored in Splunk for future audits and review.
  • QNP/QualityNet: CMS direct contractors with the approved PRS General User role have access to PII and PHI within PRS to maintain CMS Programs and provide hospital information used in Hospital Quality Reporting (HQR) applications. As a safeguard, users’ activities are logged and stored in Splunk for future audits and review.

All system and site users are required to take the “Cyber Awareness Challenge” and “Identifying Safeguarding Personal Identifiable Information (PII)” provided by ccsq Department of Defense (DoD) Cyber Exchange. In addition, they must complete the HHS Records Management Training before they are granted user credentials. This training is required to be renewed annually for all existing users.

All users are trained to perform the duties necessary to work within the system to perform their specific job functions. In addition, individuals in roles with Significant Security Responsibility (SSR) are required to complete annual Role Based Training (RBT).

PII is secured with a variety of security controls as required by CMS Acceptable Risk and Safeguards (ARS) and the CMS Security Program requirements.

Physical controls include, but are not limited to:

All physical controls inherited from AWS - the Cloud Service Provider (CSP) where QNET-ES currently resides.

Technical controls include but are not limited to:

user authentication with least privilege authorization

fire walls

Intrusion Detection and Intrusion Prevention systems (IDS/IPS)

Software configured with NIST security checklists

encrypted communications

hardware configured with a deny all/except approach

auditing and correlation of audit logs from all systems

Administrative controls include but are not limited to:

CMS Authorization to Operate

annual security assessments

monthly management of outstanding corrective action plans

ongoing risk assessments

automated continuous monitoring

background checks for all personnel

incident response procedures for timely response to security and privacy incidents

initial security training with refresher courses annually

annual role-based security training for personnel with assigned security roles and responsibilities

contingency plans and annual testing

QNP/QualityNet: QualityNet
HARP: HARP Login
UFM: HARP MTF Login 
CCSQ QualityNet Slack: HCQIS.SLACK
QualityNet SurveyMonkey: HARP Login
QualityNet Atlassian:

QualityNet Confluence: QNET Confluence

QualityNet Jira: QNET Jira

TestRail: QNET Test Rail

Udacity: Udacity