Loading
The Oregon Administrative Rules contain OARs filed through July 15, 2016
 
QUESTIONS ABOUT THE CONTENT OR MEANING OF THIS AGENCY'S RULES?
CLICK HERE TO ACCESS RULES COORDINATOR CONTACT INFORMATION

 

OREGON HEALTH AUTHORITY, HEALTH POLICY AND ANALYTICS

 

DIVISION 25

ALL-PAYER HEALTHCARE CLAIMS DATA REPORTING PROGRAM

409-025-0100

Definitions

The following definitions apply to OAR 409-025-0100 to 409-025-0170:

(1) “Accident policy” means an insurance policy that provides benefits only for a loss due to accidental bodily injury.

(2) “Allowed amount” means the actual amount of charges for healthcare services, equipment, or supplies that are covered expenses under the terms of an insurance policy or health benefits plan.

(3) “Annual supplemental provider level APM summary file” means a data set composed of total and primary care-related dollars disbursed, by payment arrangement and line of business, to billing providers and organizations with a place of business in Oregon.

(4) “APAC” means all payer all claims.

(5) “APM” means alternative payment method.

(6) “Association” means any organization, including a labor union, that has an active existence for at least one year, that has a constitution and bylaws and that has been organized and is maintained in good faith primarily for purposes other than that of obtaining insurance.

(7) “Attending provider” means the individual health care provider who delivered the health care services, equipment, or supplies specified on a health care claim.

(8) “Authority” means the Oregon Health Authority.

(9) “Billing provider” means the individual or entity that submits claims for health care services, equipment, or supplies delivered by an attending provider.

(10) “Capitated services” means services rendered by a provider through a contract in which payments are based upon a fixed dollar amount for each enrolled member on a monthly basis.

(11) “Carrier” shall have the meaning given that term in ORS 743.730.

(12) “Certificate of authority” shall have the meaning given that term in ORS 731.072.

(13) “Charges” means the actual dollar amount charged on the claim.

(14) “Claim” means an encounter or request for payment under the terms of an insurance policy, health benefits plan, Medicare, or Medicaid.

(15) "Co-insurance" means the percentage an enrolled member pays toward the cost of a covered service.

(16) “Coordinated Care Organization (CCO)” shall have the meaning given that term in ORS 414.025.

(17) "Co-payment" means the fixed dollar amount an enrolled member pays to a health care provider at the time a covered service is provided or the full cost of a service when that is less than the fixed dollar amount.

(18) “Data file” means electronic health information including medical claims files, eligibility files, medical provider files, pharmacy claims files, control totals files, subscriber-billed premiums files, APM files and any other related information specified in these rules.

(19) “Data set” means a collection of individual data records, whether in electronic or manual files.

(20) “DCBS” means the Oregon Department of Consumer and Business Services.

(21) “Deductible” means the total dollar amount an enrolled member pays toward the cost of covered services over an established period of time before the carrier or third-party administrator makes any payments under an insurance policy or health benefit plan.

(22) “De-identified health information” means health information that does not identify an individual and with respect to which there is no reasonable basis to believe that the information can be used to identify an individual.

(23) “Direct personal identifier” means information relating to an individual patient or enrolled member that contains primary or obvious identifiers, including:

(a) Names;

(b) Business names when that name would serve to identify a person;

(c) Postal address information other than town or city, state, and 5-digit zip code;

(d) Specific latitude and longitude or other geographic information that would be used to derive postal address;

(e) Telephone and fax numbers;

(f) Electronic mail addresses;

(g) Social security numbers;

(h) Vehicle identifiers and serial numbers, including license plate numbers;

(i) Medical record numbers;

(j) Health plan beneficiary numbers;

(k) Certificate and license numbers;

(l) Internet protocol (IP) addresses and uniform resource locators (URL) that identify a business that would serve to identify a person;

(m) Biometric identifiers, including finger and voice prints; and

(n) Personal photographic images.

(24) “Disability policy” means an insurance policy that provides benefits for losses due to a covered illness or disability.

(25) “Disclosure” means the release, transfer, provision of access to, or divulging in any other manner of information outside the entity holding the information.

(26) “DRC” means Data Review Committee.

(27) “Dual eligible special needs plan” means a special needs plan that enrolls beneficiaries entitled to both Medicare and Medicaid.

(28) “Eligibility file” means a data set containing demographic information for each individual enrolled member eligible for medical benefits for one or more days of coverage at any time during a calendar month for an Oregon resident as defined in ORS 803.355, a non-Oregon resident who is a member of a PEBB or OEBB group health insurance plan, or services provided in Oregon.

(29) “Eligible employee” shall have the meaning given that term in ORS 743.730.

(30) “Employee” shall have the meaning given that term in ORS 654.005.

(31) “Employer” shall have the meaning given that term in ORS 654.005.

(32) “Encrypted identifier” means a code or other means of identification to allow individual patients or enrolled members to be tracked across data sets without revealing their identity.

(33) "Encryption" means a method by which the true value of data has been disguised in order to prevent the identification of individual patients or enrolled members and does not provide the means for recovering the true value of the data.

(34) “Enrolled member” means enrollee as defined in ORS 743.730.

(35) “ERISA” means the Employee Retirement Income Security Act of 1974 (ERISA), 29 U.S.C. § 1001

(36) “Facility” means a health care facility as defined in ORS 442.015.

(37) “Genetic test” shall have the meaning given that term in ORS 192.531.

(38) “Group health insurance” shall have the meaning given that term in ORS 731.098.

(39) “Health benefit plan” shall have the meaning given that term in ORS 743.730.

(40) “Health care” shall have the meaning given that term in ORS 192.556.

(41) “Health care operations” means certain administrative, financial, legal, and quality improvement activities that are necessary to run programs including, but not limited to, conducting quality assessment and improvement activities, population-based activities relating to improving health or reducing health care costs, case management and care coordination, evaluating practitioner, provider, or health plan performance, and underwriting, enrollment, premium rating and other activities related to creation, renewal, or replacement of a health insurance contract.

(42) “Health care provider” shall have the meaning given that term in ORS 192.556.

(43) “Health information” shall have the meaning given that term in ORS 192.556.

(44) “Health insurance exchange” shall have the meaning given that term in ORS 741.300.

(45) “Healthcare Common Procedure Coding System (HCPCS)” means a medical code set, maintained by the United States Department of Health and Human Services, that identifies health care procedures, equipment, and supplies for claim submission purposes.

(46) “HIPAA” means Title II, Subtitle F of the Health Insurance Portability and Accountability Act of 1996, 42 USC 1320d, et seq. and the federal regulations adopted to implement the Act.

(47) “Hospital indemnity policy” means an insurance policy that provides benefits only for covered hospital stays.

(48) “Indirect personal identifier” means information relating to an individual patient or enrolled member that a person with appropriate knowledge of and experience with generally accepted statistical and scientific principles and methods could apply to render such information individually identifiable by using such information alone or in combination with other reasonably available information.

(49) “Individual”, when used in a list of required lines of business, means individual health benefit plans.

(50) “Individually identifiable health information” shall have the meaning given that term in ORS 192.556.

(51) “Insurance” shall have the meaning given that term in ORS 731.102.

(52) “Labor union” means any organization which is constituted for the purpose, in whole or in part, of collective bargaining or dealing with employers concerning grievances, terms or conditions of employment or of other mutual aid or protection in connection with employees.

(53) “Large group” means health benefit plans for employers with more than 50 employees.

(54) “Limited data set” means protected health information that excludes direct personal identifiers and is disclosed for research, health care operations, or to a public health authority for public health purposes.

(55) “Long-term care insurance” shall have the meaning given that term in ORS 743.652.

(56) “Managed care organization” (MCO) means a prepaid managed care health services organization as defined in ORS 414.736.

(57) “Mandatory reporter” means any reporting entity defined as a mandatory reporter in OAR 409-025-0110.

(58) “Medicaid” means medical assistance provided under 42 U.S.C. section 1396a (section 1902 of the Social Security Act), as administered by the Division of Medical Assistance Programs.

(59) “Medicaid fee-for-service”(Medicaid FFS) means that portion of Medicaid where a health care provider is paid a fee for each covered health care service delivered to an eligible Medicaid patient.

(60) “Medical claims file” means a data set composed of health care service level remittance information for all adjudicated claims for each billed service including but not limited to member demographics, provider information, charge and payment information, and clinical diagnosis and procedure codes for an Oregon resident as defined in ORS 803.355, a non-Oregon resident who is a member of a PEBB or OEBB group health insurance plan, or services provided in Oregon.

(61) “Medical provider file” means a data set containing information about health care providers providing health care services, equipment, or supplies to enrolled members during the reporting period.

(62) “Medicare” means coverage under Part A, Part B, Part C, or Part D of Title XVIII of the Social Security Act, 42 U.S.C. 1395 et seq., as amended.

(63) “Medicare Modernization Act” means the Medicare Prescription Drug, Improvement, and Modernization Act of 2003(Public Law 108-173) and the federal regulations adopted to implement the Act.

(64) “OEBB” means the Oregon Educators Benefit Board.

(65) “OMIP” means the Oregon Medical Insurance Pool.

(66) “Patient” means any person in the data set who is the subject of the activities of the claim performed by the health care provider.

(67) “Paid amount” means the actual dollar amount paid for claims.

(68) “PEBB” means the Oregon Public Employees’ Benefit Board.

(69) “Person” shall have the meaning given that term in ORS 731.116.

(70) “Pharmacy benefit manager (PBM)” means a person or entity that performs pharmacy benefit management, including a person or entity in a contractual or employment relationship with a person or entity performing pharmacy benefit management for a health benefits plan.

(71) “Pharmacy claims file” means a data set containing service level remittance information from all adjudicated claims including, but not limited to, enrolled member demographics, provider information, charge and payment information, and national drug codes for an Oregon resident as defined in ORS 803.355, a non-Oregon resident who is a member of a PEBB or OEBB group health insurance plan, or services provided in Oregon.

(72) “Pharmacy eligibility file” means a data set containing demographic information for each individual enrolled member eligible for pharmacy benefits for one or more days of coverage at any time during a calendar month for an Oregon resident as defined in ORS 803.355, a non-Oregon resident who is a member of a PEBB or OEBB group health insurance plan, or services provided in Oregon.

(73) “Policy” shall have the meaning given that term in ORS 731.122.

(74) "Prepaid amount" means the fee for the service equivalent that would have been paid for a specific service if the service had not been capitated.

(75) “Premium” shall have the meaning given that term in ORS 743.730.

(76) “Principal investigator (PI)” means the person in charge of a research project that makes use of limited data sets. The PI is the custodian of the data and shall comply with all state and federal restrictions, limitations, and conditions of use associated with the data release.

(77) “Protected health information” shall have the meaning given that term in ORS 192.519.

(78) “Public health authority” means the Public Health Division of the Authority or local public health authority as defined in ORS 431.260.

(79) “Public health purposes” means the activities of a public health authority for the purpose of preventing or controlling disease, injury, or disability including, but not limited to, the reporting of disease, injury, vital events such as birth or death, and the conduct of public health surveillance, investigations, and interventions.

(80) “Public use data set” means a publicly available data set of de-identified health information containing only the data elements specified by the Authority for inclusion.

(81) “Registered entity” means any person required to register with DCBS under ORS 744.714.

(82) “Reporting entity” means:

(a) An insurer as defined in ORS 731.106 or fraternal benefit society as defined in ORS 748.106 required to have a certificate of authority to transact health insurance business in Oregon.

(b) A health care service contractor as defined in ORS 750.005 that issues medical insurance in Oregon.

(c) A third-party administrator required to obtain a license under ORS 744.702.

(d) A pharmacy benefit manager or fiscal intermediary, or other person that is by statute, contract, or agreement legally responsible for payment of a claim for a health care item or service.

(e) A prepaid managed care health services organization as defined in ORS 414.736.

(f) An insurer providing coverage funded under Part A, Part B, or Part D of Title XVIII of the Social Security Act, subject to approval by the United States Department of Health and Human Services.

(83) “Research” means a systematic investigation, including research development, testing and evaluation, designed to develop or contribute to generalized knowledge.

(84) “Self-insured plan” means any plan, program, contract, or any other arrangement under which one or more employers, unions, or other organizations provide health care services or benefits to their employees or members in this state, either directly or indirectly through a trust or third-party administrator.

(85) “Small employer health insurance” means health benefit plans for employers whose workforce consists of at least two but not more than 50 eligible employees.

(86) “Special Needs Plan” means a Medicare health benefit plan created by the Medicare Modernization Act that is specifically designed to provide targeted care to individuals with special needs.

(87) “Specific disease policy” means an insurance policy that provides benefits only for a loss due to a covered disease.

(88) “Strongly-encrypted” means an encryption method that uses a cryptographic key with a large number of random keyboard characters.

(89) “Subscriber” means the individual responsible for payment of premiums or whose employment is the basis for eligibility for membership in a health benefit plan.

(90) “Summarized data” means data aggregated by one or more categories. Summarized data created from protected health information may not contain direct or indirect identifiers.

(91) “Third-party administrator (TPA)” means any person who directly or indirectly solicits or effects coverage of, underwrites, collects charges or premiums from, or adjusts or settles claims on, residents of Oregon or residents of another state from offices in Oregon, in connection with life insurance or health insurance coverage; or any person or entity who must otherwise be licensed under ORS 744.702.

(92) “Transact insurance” shall have the meaning given that term in ORS 731.146.

(93) “Trust” means a fund established by two or more employers in the same or related industry or by one or more labor unions or by one or more employers and one or more labor unions or by an association.

(94) “Vision policy” means a health benefits plan covering only vision health care.

(95) “Voluntary reporter” means any registered or reporting entity, other than a mandatory reporter, that voluntarily elects to comply with the reporting requirements in OAR 409-025-0100 to 409-025-0170.

Stat. Auth.: ORS 442.466
Stats. Implemented: ORS 442.464 & 442.466
Hist.: OHP 1-2010, f. 2-26-10, cert. ef. 3-1-10; OHP 4-2012, f. 5-23-12, cert. ef. 6-1-12; OHP 5-2012(Temp), f. 6-23-12, cert. ef. 6-1-12 thru 11-15-12; OHP 6-2012; f. 6-26-12, cert. ef. 7-9-12; OHP 1-2016, f. & cert. ef. 1-5-16; OHP 10-2016, f. 6-22-16, cert. ef. 1-1-17

409-025-0110

General Reporting Requirements

(1) Definition of “mandatory reporter”

(a) For carriers and licensed third-party administrators, the Authority shall identify mandatory reporters using information collected by DCBS including, but not limited to, data from the Health Insurance Member Enrollment Report.

(A) The Authority shall aggregate the most recent four quarters of data.

(B) The Authority shall calculate the mean total lives for each carrier and licensed third-party administrator.

(C) All carriers and licensed third-party administrators with calculated mean total lives of 5,000 or higher shall be mandatory reporters.

(b) All PBMs shall be mandatory reporters.

(c) All MCOs shall be mandatory reporters.

(d) All CCOs shall be mandatory reporters.

(e) All reporting entities with Dual Eligible Special Needs Plans in Oregon shall be mandatory reporters.

(f) All insurers providing coverage funded under Part A, Part B or Part D of Title XVIII of the Social Security Act, subject to approval by the United States Department of Health and Human Services.

(g) All insurers offering a health benefits plan in Oregon’s health insurance exchange shall be mandatory reporters.

(2) Voluntary reporters may elect to participate by notifying the Authority in writing.

(3) Mandatory and voluntary reporters shall submit data files for all required lines of business. They may submit data files for the voluntary lines of business and may not submit data files for any excluded lines of business.

(a) Required lines of business include:

(A) Medicare (parts C and D);

(B) Medicaid;

(C) Individual;

(D) Small employer health insurance;

(E) Large group;

(F) Associations and trusts;

(G) PEBB and OEBB group health insurance plans; and

(H) Self-insured plans not subject to ERISA.

(b) Voluntary lines of business include self-insured plans subject to ERISA.

(c) Excluded lines of business include:

(A) Accident policy;

(B) Dental insurance;

(C) Disability policy;

(D) Hospital indemnity policy;

(E) Long-term care insurance;

(F) Medicare supplemental insurance;

(G) Specific disease policy;

(H) Stop-loss plans;

(I) Student health policy;

(J) Vision-only insurance; and

(K) Workers compensation.

(4) Mandatory and voluntary reporters shall comply with data file layout, format, and coding requirements in OAR 409-025-0120.

(5) Mandatory and voluntary reporters shall comply with data submission requirements in OAR 409-025-0130.

(6) Unless otherwise required by state or federal rules, regulations or statutes, mandatory and voluntary reporters may not submit claims subject to stricter disclosure limits imposed by state or federal rules, regulations, or statutes.

(7) The Authority shall provide written notification by July 1 of each year to all mandatory reporters subject to the reporting requirements of OAR 409-025-0100 to 409-025-0170 for the following calendar year.

Stat. Auth.: ORS 442.466
Stats. Implemented: ORS 442.464 & 442.466
Hist.: OHP 1-2010, f. 2-26-10, cert. ef. 3-1-10; OHP 4-2012, f. 5-23-12, cert. ef. 6-1-12; OHP 5-2012(Temp), f. 6-23-12, cert. ef. 6-1-12 thru 11-15-12; OHP 6-2012; f. 6-26-12, cert. ef. 7-9-12; OHP 1-2016, f. & cert. ef. 1-5-16; OHP 10-2016, f. 6-22-16, cert. ef. 1-1-17

409-025-0120

Data File Layout, Format, and Coding Requirements

(1) All data files shall include:

(a) Medical claims;

(b) Eligibility;

(c) Medical provider;

(d) Pharmacy claims;

(e) Control totals;

(f) Subscriber billed premiums;

(g) Annual supplemental provider level APM summary; and

(h) Control totals for annual supplemental provider level APM summary.

(2) The medical claims file shall be submitted using the approved layout, format, and coding described in Appendix A.

(3) The eligibility file shall be submitted using the approved layout, format, and coding described in Appendix B.

(a) Mandatory reporters shall report race and ethnicity data as outlined in Appendix B. This layout aligns with the Office of Management and Budget’s (OMB) Federal Register Notice of October 30, 1997 (62 FR 58782-58790).

(b) Mandatory reporters shall report primary language in accordance with ANSI/NISO guidance using the three-character string outlined in Codes for the Representation of Languages for Information Interchange.

(c) Race, ethnicity and primary language data shall be collected in a manner that aligns with the following principles:

(A) To the greatest extent practicable, race, ethnicity, and preferred language shall be self-reported.

(i) Collectors of race, ethnicity and primary language data may not assume or judge ethnic and racial identity or preferred signed, written and spoken language, without asking the individual.

(ii) If an individual is unable to self-report and a family member, advocate, or authorized representative is unable to report on his or her behalf, the information shall be recorded as unknown.

(B) When an individual declines to identify race, ethnicity or preferred language, the information shall be reported as refused.

(4) The medical provider file shall be submitted using the approved layout, format, and coding described in Appendix C.

(5) The pharmacy claims file shall be submitted using the approved layout, format, and coding described in Appendix D.

(6) The control totals file shall be submitted using the approved layout, format, and coding described in Appendix E.

(7) The subscriber billed premium file shall be submitted using the approved layout, format, and coding described in Appendix F.

(8) The annual supplemental provider level APM summary file shall be submitted using the approved layout, format, and coding described in Appendix G.

(9) The control totals for annual supplemental provider level APM summary file shall be submitted using the approved layout, format, and coding described in Appendix H.

(10) All data elements are required unless specified as optional or situational.

(11) All required data files shall be submitted as delimited ASCII files.

(12) Numeric data are positive integers unless otherwise specified.

(a) Negative values are allowed for revenue codes, quantities, charges, payment, co-payment, co-insurance, deductible, and prepaid amount.

(b) Negative values shall be preceded by a minus sign.

(13) The Authority shall convene a technical advisory group to advise the Authority and associated contractors on submission specifications including but not limited to Appendices A-H, Schedule A and any additional data submission requirements. The advisory group shall include, but is not limited to representatives from:

(a) Mandatory reporters;

(b) Providers;

(c) Researchers, and;

(d) Other stakeholders and interested parties.

(14) All data files shall pass edit checks and validations implemented by the Authority or the data vendor.

(a) Data vendors may perform quality and edit checks on data file submissions. If data files do not pass data vendor edit checks or validation, mandatory reporters must make corrections and resubmit data. Mandatory reporters must submit corrected data or an exception request within 14 calendar days of notification of error.

(b) Mandatory reporters must participate in efforts to validate and check the quality of current and historic APAC data, as prescribed and requested by the Authority.

(A) The Authority may request from mandatory reporters information from their internal records that is reasonably necessary to validate and check the quality of APAC data. This information may include, but is not limited to, aggregated number of enrolled members, number of claims and claim lines, charges, allowed amounts, paid amounts, co-insurance, co-payments, premiums, number of visits to primary care, emergency department, inpatient, and other health care treatment settings, and number of prescriptions.

(B) Mandatory reporters shall provide the aggregated information within 30 days of the Authority’s request.

(C) If the Authority finds errors through edit checks or validation, mandatory reporters must make corrections and resubmit data or submit an exception request within 30 days or at the next regularly scheduled submission due date.

[ED. NOTE: Appendices referenced are not included in rule text. Click here for PDF copy of appendice(s).]

Stat. Auth.: ORS 442.466
Stats. Implemented: ORS 442.464 & 442.466
Hist.: OHP 1-2010, f. 2-26-10, cert. ef. 3-1-10; OHP 4-2012, f. 5-23-12, cert. ef. 6-1-12; OHP 1-2016, f. & cert. ef. 1-5-16; OHP 10-2016, f. 6-22-16, cert. ef. 1-1-17

409-025-0130

Data Submission Requirements

(1) Mandatory reporters shall submit data files as specified in Schedule A. Voluntary reporters may consult with the Authority to submit healthcare claims data files on an alternative schedule.

(2) Mandatory and voluntary reporters shall submit data files directly to the data vendor unless otherwise specified by the Authority.

(3) Mandatory and voluntary reporters shall transmit data files using one of the following approved processes:

(a) Secure file transfer protocol (SFTP) including separate strong encryption of data files prior to SFTP transmission; or

(b) Any process incorporating strong encryption that is approved in writing by both the Authority and the data vendor.

[ED. NOTE: Appendices referenced are not included in rule text. Click here for PDF copy of appendice(s).]

Stat. Auth.: ORS 442.466
Stats. Implemented: ORS 442.464 & 442.466
Hist.: OHP 1-2010, f. 2-26-10, cert. ef. 3-1-10; OHP 4-2012, f. 5-23-12, cert. ef. 6-1-12; OHP 1-2016, f. & cert. ef. 1-5-16; OHP 10-2016, f. 6-22-16, cert. ef. 1-1-17

409-025-0140

Waivers and Exceptions

(1) The Authority may grant a waiver, deadline extension, or exception to the reporting and validation requirements.

(2) Mandatory reporters shall notify the Authority of their inability to meet requirements.

(a) A mandatory reporter shall submit a Waiver or Exception of Reporting Requirements Form (APAC-1) to the Authority. Mandatory reporters may submit an APAC-1 form for the following reasons:

(A) To request an exception to the data file layout, format or threshold prior to data submission. The request shall be submitted 14 calendar days prior to the applicable reporting deadline;

(B) To request a deadline extension for any of the following scenarios: initial submission, data correction or validation. The request shall be submitted 14 calendar days prior to the applicable reporting deadline; or

(C) To request a waiver of all reporting or validation requirements. The request shall be submitted 60 calendar days prior to the applicable reporting deadline.

(b) Mandatory reporters seeking exception requests for data element formats or thresholds during the current data file submissions shall submit a request to the Authority’s data vendor, using the data vendor’s online interface. Requests must be made at time of quarterly submission.

(c) The Authority shall approve or deny the waiver or exception request and provide written notification to the requestor within 14 calendar days of receipt of the request.

(d) If the Authority denies the request, the requestor may appeal the denial by requesting a contested case hearing. The appeal must be filed within 30 business days of the denial. The appeal process is conducted pursuant to ORS Chapter 183 and the Attorney General’s Uniform and Model rules of Procedure for the Office of Administrative Hearings, OAR 137-003-0501 to 137-003-0700. The requestor shall have the burden to prove a compelling need for the waiver or exception.

(e) The waiver or exception shall expire at the end of the calendar year unless otherwise specified by the Authority.

[ED. NOTE: Forms referenced are available on the agency’s website at http://www.oregon.gov/oha/OHPR/RSCH/pages/apac.aspx]

Stat. Auth.: ORS 442.466
Stats. Implemented: ORS 442.464 & 442.466
Hist.: OHP 1-2010, f. 2-26-10, cert. ef. 3-1-10; OHP 1-2016, f. & cert. ef. 1-5-16

409-025-0150

Compliance and Enforcement

Penalties for failure to comply shall be enforced by the Authority.

(1) Unless approved by a waiver or exception, failure to comply with general reporting requirements shall include but is not limited to:

(a) Failure to submit data files for a required line of business; and

(b) Submitting health information for an excluded line of business.

(2) Unless approved by a waiver or exception, failure to comply with data file requirements shall include but is not limited to:

(a) Submitting a data file in an unapproved layout;

(b) Submitting a data element in an unapproved format;

(c) Submitting a data element with unapproved coding;

(d) Failure to submit a required data element; or

(e) Failure to comply with validation and quality control efforts, including resubmitting or correcting data as requested by the Authority.

(3) Unless approved by a waiver or exception, failure to comply with data submission requirements shall include but is not limited to:

(a) Failure to submit test files as specified by the data vendor;

(b) Submitting data files later than five days after the submission due date as outlined in Schedule A;

(c) Rejection of a data file by the data vendor that is not resubmitted or corrected by the submitter within 14 calendar days from notification of error; or

(d) Transmitting data files using an unapproved process.

(4) The Authority shall provide mandatory reporters written notification of each failure to comply.

(5) The Authority may impose fines of up to $500 per day for each failure to comply that is not resolved within 30 calendar days of written notification.

(6) If a mandatory reporter has made documented efforts to comply with these rules, the Authority may consider this a mitigating factor before imposing regulatory action against the mandatory reporter.

[ED. NOTE: Appendices referenced are not included in rule text. Click here for PDF copy of appendice(s).]

Stat. Auth.: ORS 442.466 & 442.993
Stats. Implemented: ORS 442.464, 442.466 & 442.993
Hist.: OHP 1-2010, f. 2-26-10, cert. ef. 3-1-10; OHP 1-2016, f. & cert. ef. 1-5-16; OHP 10-2016, f. 6-22-16, cert. ef. 1-1-17

409-025-0160

Data Access and Release

(1) The Authority shall comply with all relevant state and federal data privacy, security, and antitrust regulations, including The Health Insurance Portability and Accountability Act (HIPAA), when sharing APAC data.

(2) The Authority may collect payment to recoup costs when APAC data requests are fulfilled.

(3) The Authority shall provide a public use data set, which shall include de-identified health information, in compliance with applicable Authority policies and state and federal rules, regulations, and statutes.

(a) The Authority shall maintain a list of data elements that may be included in APAC public use data sets. The public use data sets shall comply with applicable Authority policies and state and federal rules, regulations, and statutes.

(b) Requestors seeking access to an APAC public use data set shall complete a Pre-Application for APAC Data Files (APAC-2) and comply with the application procedures for public use data sets outlined on the APAC website.

(c) The Authority shall approve or deny the completed request and provide written notification to the requestor within 30 calendar days of receipt of the request.

(d) The Authority shall deny the completed request for reasons which include, but are not limited to:

(A) Requestor or any person who will have access to the data has previously violated a data use agreement with the Authority.

(B) The Authority finds that the specific details of the request do not sufficiently explain the proposed use.

(C) The Authority finds that the specific details of the request violate any state or federal rule, regulation, or statute.

(D) Full payment is not included with the application.

(e) If the Authority denies the Pre-Application for APAC Data Files (APAC-2):

(A) The Authority shall provide written notification stating the reason for the denial; and

(B) The requestor may appeal the denial by requesting a contested case hearing. The appeal must be filed within 30 business days of the denial. The appeal process is conducted pursuant to ORS chapter 183 and the Attorney General’s Uniform and Model Rules of Procedure, OAR 137-003-0501 to 137-003-0700. The requestor shall have the burden to prove that the Authority unreasonably denied the application.

(f) The public use data sets may not be used to identify any individual, including but not limited to patients, physicians, and other health care providers. The requestor may not use outside information to attempt to ascertain the identity of particular individuals who are the subject of public use data sets.

(4) The Authority shall provide limited data sets, in compliance with applicable Authority policies and state and federal rules, regulations, and statutes. Limited data sets may include protected health information from which certain direct identifiers have been removed.

(a) The Authority shall maintain a list of data elements that may be included in APAC limited data sets.

(b) APAC limited data sets may be disclosed for purposes allowed by state and federal regulations, including research, public health, and health care operations.

(c) Requestors seeking access to APAC limited data sets shall complete the Pre-Application for APAC Data Files (APAC-2). The Authority may require requestors to provide additional information by completing the Application for APAC Data Files (APAC-3). Requestors must comply with the application procedures for limited data sets outlined on the APAC website.

(5) The Authority shall create a process to request custom data sets.

(a) APAC custom data sets may be disclosed for purposes allowed by state and federal regulations, including research, public health, and health care operations.

(b) Requestors seeking access to APAC custom data sets shall complete the Pre-Application for APAC Data Files (APAC-2). The Authority may require requestors to provide additional information by completing the Application for APAC Data Files (APAC-3). Requestors must comply with the application procedures for custom data sets outlined on the APAC website.

(6) The Authority shall review for completeness all applications and provide requestors written notification of completeness within 30 calendar days of receipt of the request.

(a) If the Authority determines that the application is incomplete, the requestor shall have 30 calendar days from notification of incompleteness to complete the application. Incomplete applications that are not completed shall be discarded without further notification to the requestor.

(b) The Authority shall convene a Data Review Committee (DRC) to evaluate completed applications.

(A) The Authority may accept nominations for and make appointments to the DRC. The DRC shall include at least one mandatory reporter to serve in an advisory capacity.

(B) The DRC evaluation shall include, but is not limited to:

(i) Whether proposed purpose for accessing APAC data is allowable under Authority policies and state and federal rules, regulations, and statutes;

(ii) Whether IRB documentation is required and, if submitted, sufficient.

(iii) Whether the proposed privacy and security protections are sufficient.

(iv) Whether additional clarification is needed to complete the review.

(C) The Authority shall publish a DRC meeting schedule on its website and post applications scheduled to be reviewed, which detail the proposed use of the data and detail the data elements requested to be released, at least two weeks prior to the next DRC meeting. The Authority shall receive public comment on applications scheduled for review. The DRC will review and consider all public comments as part of the data request review process.

(D) The Authority shall schedule completed applications for review by the DRC on a first-come-first-served basis.

(E) The DRC shall recommend that The Authority approve or deny the application, or defer action pending clarification from the requestor.

(F) The Authority shall accept or reject the DRC’s recommendation and notify the requestor within ten business days of the review.

(G) The Authority shall deny a completed application for reasons which include, but are not limited to:

(i) Requestor or any person who will have access to the data has previously violated a data use agreement with the Authority.

(ii) Full payment is not included with the application.

(iii) The proposed privacy and security protections are not sufficient.

(iv) Information provided is not sufficient to approve the request.

(v) Proposed purpose for accessing APAC data is not allowable under authority policies or state or federal rules, regulations, or statutes.

(H) If the DRC requests clarification, the requestor shall have 30 calendar days to provide the requested information to the Authority. After 30 calendar days, applications with incomplete requests for clarification shall be discarded without further notification to the requestor.

(I) Upon receipt of the requested clarification the Authority shall schedule re-evaluation with the DRC on a first-come-first-served basis.

(J) If the Authority denies the application:

(i) The Authority shall provide written notification stating the reason for the denial.

(ii) The requestor may appeal the denial by requesting a contested case hearing. The appeal must be filed within 30 business days of the denial. The appeal process is conducted pursuant to ORS Chapter 183 and the Attorney General’s Uniform and Model rules of Procedure, OAR 137-003-0501 to 137-003-0700. The requestor shall have the burden to prove that the Authority unreasonably denied the application.

[ED. NOTE: Forms and lists referenced are available on the agency’s website: http://www.oregon.gov/oha/OHPR/RSCH/pages/apac.aspx]

Stat. Auth.: ORS 442.466
Stats. Implemented: ORS 442.464 & 442.466
Hist.: OHP 1-2010, f. 2-26-10, cert. ef. 3-1-10; OHP 4-2012, f. 5-23-12, cert. ef. 6-1-12; OHP 2-2013, f. 1-24-13, cert. ef. 2-1-13; OHP 1-2016, f. & cert. ef. 1-5-16; OHP 1-2016, f. & cert. ef. 1-5-16

409-025-0170

Public Disclosure

(1) The Authority and applicable contractors, shall perform data analyses and publish data and reports that serve the public’s interest. This may include, but is not limited to:

(a) Comparing healthcare cost and quality;

(b) Assessing health care utilization;

(c) Assessing the capacity and distribution of healthcare resources;

(d) Assessing health care purchasing decisions;

(e) Assessing the effectiveness of public health programs; or

(f) Assessing disparities in health care delivery and outcomes.

(2) The Authority may convene advisory groups to advise the Authority on topics related to the All Payer All Claims Reporting Program. The advisory groups shall include, but not be limited to representatives from:

(a) Mandatory reporters, including carriers, TPAs, PBMs, and CCOs; and;

(b) Other stakeholders and interested parties.

Stat. Auth.: ORS 442.466
Stats. Implemented: ORS 442.464 & 442.466
Hist.: OHP 1-2010, f. 2-26-10, cert. ef. 3-1-10; OHP 1-2016, f. & cert. ef. 1-5-16

The official copy of an Oregon Administrative Rule is contained in the Administrative Order filed at the Archives Division, 800 Summer St. NE, Salem, Oregon 97310. Any discrepancies with the published version are satisfied in favor of the Administrative Order. The Oregon Administrative Rules and the Oregon Bulletin are copyrighted by the Oregon Secretary of State. Terms and Conditions of Use