Qualified Health Plan Directory Pilot

The Qualified Healthcare Plan (QHP) Directory Pilot single source of truth database will be prepared using publicly available provider directory data from several sources such as NPPES (National Plan and Provider Enumeration System), machine readable, Transformed Medicaid Statistical Information System (T-MSIS), and Network Adequacy. 

This data will be ingested and cleansed, flowing through a data store in a medallion architecture. The QHP Directory Pilot application will include a web portal that can be accessed by providers, CMS personnel, and contractor Application Development Organization (ADO) personnel via authenticated login. 

The QHP Directory Pilot application will access a database that contains the single source of truth provider directory information. Providers will be able to update data that is associated with their NPI to correct as needed. 

The QHP Directory Pilot application will access a database that contains the single source of truth provider directory information. Providers will be able to update data that is associated with their National Provider Identifier (NPI) to correct as needed. Data collected, stored and transmitted includes provider information: 

Full name,
Date of Birth, 
Sex, 
Race, 
Ethnicity, 
NPI number, 
Medical specialty, 
State license, 
Medical credentials, 
Physical address, 
Email address, 
Phone number.

QHP Directory will not store or save data related to SSN or TIN.  The aforementioned data will be retrieved from CMS IAM when users sign in.  The information will be displayed to the user, but will not persist in the Single Source of Truth database.

The QHP Directory Pilot single source of truth database will be prepared using publicly available provider directory data from several sources including: NPPES , machine readable, T-MSIS, and Network Adequacy. 

This data will be ingested and cleansed, flowing through a data store in a medallion architecture. The QHP Directory Pilot application will include a web portal that can be accessed by providers, CMS personnel, and contractor ADO personnel via authenticated login. 

The QHP Directory Pilot application will access a database that contains the single source of truth provider directory information. Providers will be able to update data that is associated with their NPI to correct as needed. Data collected, stored, and transmitted includes provider information: 

Full name, 
Date of Birth, 
Sex, 
Race, 
Ethnicity, 
NPI number, 
Medical specialty, 
State license, 
Medical credentials, 
Physical address, 
Email address, 
Phone number.

QHP Directory Pilot will not store or save data related to Social Security Number (SSN) or Tax Identification Number (TIN).  The aforementioned data will be retrieved from CMS Identity and Access management (IAM) when users sign in.  The information will be displayed to the user, but will not persist in the Single Source of Truth database. QHP Directory Pilot will use CMS IDM platform to authenticate CMS and contractor users and will use CMS IAM platform to authenticate provider users.

• Social Security Number
• Name
• E-Mail Address
• Phone Numbers
• Date of Birth
• Mailing Address
• Other - Full name, Sex, Race, Ethnicity, NPI number, Medical specialty, State license, Medical credentials, Physical address, NDH will not store or save data related to SSN or TIN. Information will be displayed on sign in, but will not persist in the database.

• Employees
• Public Citizens
• Business Partners/Contacts (Federal, state, local agencies)
• Vendors/Suppliers/Contractors

• In-person
• Online
• Email

• Within the OPDIV

• Private Sector

OMB control number (approved 8/15/22):

CMS-10803/OMB control number: 0938-NEW;

CMS-10803/OMB control number: 0938-1415

Expiration Date 12/31/2027

Users will see the following displayed on login:

PII Disclosure

The Centers for Medicare & Medicaid Services (CMS) is committed to ensuring the security of your Personally Identifiable Information (PII). This policy outlines the types of PII we collect, how we use and protect it, and your rights regarding this information.

Information We Collect
PII refers to any information that can be used to identify an individual, either on its own or when combined with other data. CMS may collect the following PII when you engage [KB1] with the QHP Directory Pilot:

Name
Email address
Mailing address
Phone number
Sex
Race
Ethnicity
NPI number
State license
Date of Birth

In addition, the following technical details are collected automatically when you interact with the QHP Directory Pilot:

IP address and approximate geographic location
Browser type and operating system
Date and time of access
Pages visited within the platform

How We Use Your Information
We collect and use your PII to[KB2] :

Provide access to the QHP Directory Pilot

Communicate important updates or respond to inquiries

Verify your identity and maintain the integrity of our systems

Comply with federal laws and regulations

How We Protect Your Information
CMS implements administrative, technical, and physical safeguards to ensure the security and confidentiality of your PII. These measures include encryption, access controls, and secure data storage to protect against unauthorized access, disclosure, or misuse.

Sharing of Information
CMS does not sell or share your PII for commercial purposes. We may disclose your PII only when required by law, for legitimate government functions, or with authorized entities to facilitate program operations, as permitted under applicable privacy laws and regulations.

Your Rights and Choices
You have the right to:

Request access to the PII CMS holds about you

Correct or update inaccuracies in your PII

Request deletion of your PII, subject to legal and operational requirements

Inquire about how CMS protects and uses your data

Contact Information
For questions or concerns regarding this policy, or to exercise your rights, please contact CMS at CMS Privacy.

This policy is subject to updates. Any material changes will be communicated through official CMS channels.

Individuals can change PII related information by editing their provider information after logging into the QHP Directory Pilot Portal. This PII that can be edited by users includes full name, phone number, date of birth, email address, and physical address. If PII has been inappropriately disclosed, obtained or used, users will receive written notice regarding privacy breaches. HHS Office for Civil Rights can receive individual's concerns regarding PII or PHI which can then notify CMS of potential issues.

CMS Federal Executives

• Users: Users are required to view PII associated with their account only to make edits as needed to maintain an accurate provider directory.
• Administrators: An administrator has access to PII to facilitate correction of user data and to administer databases, on an as-needed basis. Also, administrators conducting monthly audits access system logs that show users ID and time and date of the system access.
• Contractors: Direct contractor personnel will perform the administrator role.  An administrator has access to PII to facilitate correction of user data and to administer databases, on an as-needed basis. Also, administrators conducting monthly audits access system logs that show users ID and time and date of the system access.

• Session Cookies: No
• Persistent Cookies: No