(1) Public Use Files. The Council shall create three public use files of the Health Care Claims Data, including the Member Eligibility (ME) data, Medical Claims (MC) data, and Pharmacy Claims (PC) data.

1. (a) Level 1. The Level 1 file includes the following Data Elements:

   Data Element # Data Element Name

   ME003 Insurance Type ME004 Year of Reported Eligibility ME005 Month of Reported Eligibility ME007 Coverage Level Code ME012 Individual Relationship Code ME013 Member Gender ME016 Member State or Province ME018 Medical Coverage -Yes/No ME019 Prescription Drug Coverage -Yes/No ME020 Race 1 ME021 Race 2 ME022 Other Race ME023 Hispanic Indicator -Yes/No ME024 Ethnicity 1 ME025 Ethnicity 2 ME026 Other Ethnicity MC003 Insurance Type/Product Code MC011 Individual Relationship Code MC012 Member Gender MC019 Admission Hour MC020 Admission Type MC021 Admission Source MC022 Discharge Hour MC023 Discharge Status

   Length of Stay (LOS)

   MC027 Service Provider Entity Type Qualifier MC031 Service Provider Suffix MC034 Service Provider State MC035A Service Provider Country Name MC036 Type of Bill -on Facility Claims MC037 Site of Service -on NSF/CMS 1500 Claims MC038 Claim Status MC039 Admitting Diagnosis MC040 E-Code MC041 Principal Diagnosis

   Data Element # Data Element Name (continued)

   MC042 Other Diagnosis -1 MC043 Other Diagnosis -2 MC044 Other Diagnosis -3 MC045 Other Diagnosis -4 MC046 Other Diagnosis -5 MC047 Other Diagnosis -6 MC048 Other Diagnosis -7 MC049 Other Diagnosis -8 MC050 Other Diagnosis -9 MC051 Other Diagnosis -10 MC052 Other Diagnosis -11 MC053 Other Diagnosis -12 MC054 Revenue Code MC055 Procedure 1 Code MC056 Procedure 1 Modifier- 1 MC057 Procedure 1 Modifier -2 MC058 ICD-9-CM Procedure 1 Code MC061 Quantity MC065 Copay Amount MC067 Deductible Amount PC003 Insurance Type/Product Code PC011 Individual Relationship Code PC012 Member Gender PC017 Date Service Approved (AP Date) PC024A Pharmacy Country Name PC025 Claim Status PC026 Drug Code PC027 Drug Name PC028 New Prescription PC028A Refill Number PC029 Generic Drug Indicator PC030 Dispense as Written Code PC031 Compound Drug Indicator PC033 Quantity Dispensed PC034 Days Supply PC037 Average Wholesale Price (AWP) PC038 Postage Amount Claimed PC039 Dispensing Fee PC040 Copay Amount PC042 Deductible Amount

(b) Level 2. The Level 2 file includes all the data elements in Level 1 plus the following data elements:

Data Element # Data Element Name

ME001 Payer ME002 National Plan ID ME008 Encrypted Subscriber Unique Identification Number ME009 Plan Specific Contract Number ME010 Member Suffice or Sequence Number ME011 Member Identification Code

Member Age in Years Member Age in Months

ME015 Member City Name ME017 Member ZIP Code

Data Element # Data Element Name (continued)

MC001 Payer MC002 National Plan ID MC004 Payer Claim Control Number MC005 Line Counter MC005A Version Number MC007 Encrypted Subscriber Unique Identification Number MC008 Plan Specific Contract Number MC009 Member Suffix or Sequence Number MC010 Member Identification Code MC014 Member City Name MC015 Member State or Province MC016 Member ZIP Code MC017 Date Service Approved (AP Date) MC018 Admission Date MC022A Discharge Date

Member Age in Years at Discharge Member Age in Months at Discharge

MC024 Service Provider Number MC025 Service Provider Tax ID Number MC026 National Service Provider ID MC028 Service Provider First Name MC029 Service Provider Middle Name MC030 Service Provider Last Name or Organization Name MC032 Service Provider Specialty MC033 Service Provider City Name MC035 Service Provider ZIP Code MC059 Date of Service -From MC060 Date of Service -Thru MC062 Charge Amount MC063 Paid Amount MC064 Prepaid Amount MC066 Coinsurance Amount

1. (c) Level 3. The Level 3 file includes all the data elements in Level 2 plus the following data elements:

   Data Element # Data Element Name

   ME006 Insured Group or Policy Number ME014 Member Date of Birth MC006 Insured Group or Policy Number MC013 Member Date of Birth PC006 Insured Group Number PC013 Member Date of Birth

(2) Data Release Review Board. The Council shall designate a Data Release Review Board to review applications for Health Care Claims Data filed pursuant to M.G.L. c. 6A, § 16K.

1. (a) Members. The Board shall include at least one member of the Councilor Council member's designee; one member of the Council's Advisory Committee (established pursuant to M.G.L. c. 6A, § 16L); an attorney with expertise in health data privacy issues; a data security expert; a representative of a hospital licensed in Massachusetts; a clinician licensed to practice in Massachusetts; and any other individual whom both the Councilor designated Council staff deem necessary for the review and evaluation of applications for Health Care Claims Data. The Board shall include at least one person who has expertise using statistics, clinical data, demographic data, and payment data.
2. (b) Terms. Members of the Board shall be appointed to serve for two years, but may be removed by a vote of the majority of the Council.

3. (c) Administration. Under the Board's direction and authority, Council staff shall:

   1. 1. develop standard application materials;
   2. 2. review all applications for Health Care Claims Data;
   3. 3. ensure that all applications for Health Care Claims Data are complete;
   4. 4. process and approve applications for Level 1 Data Elements that meet the requirements of 129 CMR 3.03 through 3.05 and that do not involve any Level 2 data elements;
   5. 5. refer to the Board for review all applications for Level 2 Data Elements and any other applications that the Administrative Director or Council staff deem appropriate for the Board's review;
   6. 6. reject all applications for Level 3 Data, except those applications received from state agencies pursuant to 129 CMR 3.03(4);
   7. 7. refer all applications for Level 3 Data received from state agencies to the Board for review and action by the Board; and
   8. 8. prepare materials for presentation to the Board.
4. (d) Meetings. The Board shall meet regularly according to a schedule set by the Council to review applications for Level 2 and Level 3 Data Elements and to review applications for any other Health Care Claims Data that Council staff deems appropriate for the Board's review.

5. (e) Criteria for Release of Data. The Board will review the proposed use of the data, the credentials of the applicant, and the nature of the data requested. The Board shall, at a minimum, consider the following factors:

   1. 1. whether the proposed use of the data will jeopardize patient privacy;
   2. 2. whether the proposed disclosure may enable collusion or anti-competitive conduct;
   3. 3. the effect of the proposed use on the quality and costs of health care; and
   4. 4. whether the proposed use will further the public interest by promoting improvements in health care quality or reductions in the growth of health care costs.

(3) Application Review Procedures.

1. (a) Applications for Data. All data applicants requesting access to, disclosure of, or use of Health Care Claims Data shall submit a written application using a form approved by the Council. In accordance with 129 CMR 3.03(3), only state agencies may apply for Level 3 Data.

2. (b) Application Requirements. All applicants shall:

   1. 1. specify the purpose and intended use of the data requested, including a detailed project description;
   2. 2. specify each data field requested;
   3. 3. justify the need for each requested Level 2 Data Element to accomplish the applicant's stated purpose;
   4. 4. specify the applicant's qualifications to perform such research or accomplish the intended use;
   5. 5. specify administrative, security and privacy measures to be taken to safeguard the confidentiality of patient information, payment rates, and any Level 2 and Level 3 Data Elements that the Board permits to be released, and to prevent unauthorized access to or use of such data;
   6. 6. specify the applicant's methodology for maintaining data integrity and accuracy;
   7. 7. identify all employees who will have access to the requested Health Care Claims Data, and describe the activities they will conduct with the data and their qualifications to conduct those activities;
   8. 8. specify whether the applicant intends to engage an agent or contractor to conduct any function with the requested data and if so, identify such functions, describe the agent's or contractor's qualifications, state whether the agent or contractor will have access to the data at a location other than the applicant's location or in an off-site server and/or database, and specify all data security measures to be instituted with such agent or contractor;
   9. 9. specify measures the applicant, his/her employees, and his/her agents will take to return the original released data to the Council at the conclusion of the applicant's use and to destroy all copies of the data remaining in the applicant's, his/her employee's and his/her agent's possession or control;
   10. 10. specify research protocols, as applicable;
   11. 11. specify whether the data will be linked to or used in conjunction with other data sources and if so, identify such data sources and explain the purpose for such linking and whether such linking would enable re-identification of the requested data elements;
   12. 12. specify the applicant's plans to publish or otherwise disclose any Level 1, Level 2 and Level 3 Data Elements, or any data derived or extracted from such data, in any paper, report, website, statistical tabulation, or similar document; and
   13. 13. agree to pay the application fee or request a waiver of the fee.

3. (c) Criteria for Approval. The Board may approve for release to an applicant only the requested Health Care Claims Data that the Board determines is necessary to accomplish the applicant's purpose and intended use. Factors the Board may consider in determining whether to exercise its discretion to approve an application for Health Care Claims Data include, but are not limited to, the following:

   1. 1. the purpose for which the data is requested is in the public interest and is consistent with the mission and goals of the Council. Uses that serve the Council's mission and the public interest include, but are not limited to: health cost, quality and utilization analyses to formulate public policy; financial studies and analysis of hospital payment systems; utilization review studies; studies to develop indicators of quality of care and to identify areas for improvement; health care facility merger analyses; health planning and resource allocation studies; epidemiological studies, including the identification of morbidity and mortality patterns, and studies of prevalence and incidence of diseases; and research studies and investigation of other health care issues;
   2. 2. the applicant has demonstrated it is qualified to undertake the study or accomplish the intended use;
   3. 3. the applicant requires such data in order to undertake the study or accomplish the intended use;
   4. 4. the applicant can ensure that patient privacy will be protected;
   5. 5. the applicant can ensure that the identities of clinicians will be kept confidential;
   6. 6. the applicant can ensure that individual payment rates will be kept confidential;
   7. 7. the applicant can safeguard against unauthorized use and disclosure;
   8. 8. the applicant signs a Data Use Agreement that sets forth its agreement to comply with data release restrictions, prohibitions, and protections for the Council's Data; and
   9. 9. the applicant requires that any staff or agent that will have access to or process the data on the applicant's behalf agrees to follow all data restrictions, prohibitions, and protections set forth in 129 CMR 3.00 and the Data Use Agreement.

(4) Data Release Procedures.

1. (a) The Council shall establish a regular schedule for submission of applications and for review by the Board. The schedule shall provide that the Board will make reasonable efforts to notify each applicant of the Board's decision within 45 days of the scheduled application submission date.
2. (b) The Board shall authorize access to data containing the fewest number of Data Elements necessary to accomplish the applicant's purpose or intended use. Similarly, if the Board determines that not all of the elements the applicant has requested are consistent with the applicant's intended use and purpose or with the mission and goals of the Council, or that release of certain requested elements may jeopardize patient privacy , or may enable collusion or anti-competitive conduct or may involve a likelihood of increasing health care costs, the Board may authorize the release of only those Data Elements that the Board deems consistent with the applicant's purpose and intended use or the Council's mission and goals or the release of which will not jeopardize patient privacy, enable collusion or anti-competitive conduct, or involve a likelihood of increasing health care costs.
3. (c) If the application is incomplete or if the Board determines that supplemental information is needed to make its decision, the Board may require such supplemental information and notify the applicant accordingly. The Board's request for supplemental information from the applicant will trigger a new 45-day notification period (as set forth 129 CMR 3.03(2)(a)): a new 45-day notification period will begin to run on the date the applicant must provide the supplemental information to the Board (the date to be determined by the Board) or the date the applicant in fact provides the supplemental information to the Board, whichever is later.
4. (d) If the Board denies an application for data in whole or in part, the Board will notify the applicant of the reason for denial.
5. (e) An applicant may resubmit his or her application to address the concerns raised by the Board in its decision. The Board may reconsider a determination made under 129 CMR 3.03 based on new information or any other reasonable cause.
6. (f) An applicant may appeal the denial of any application for data release by the Board to the Council. Such appeal must be filed within 30 days of the Board's decision and must specify the reason(s) that the applicant considers the Board's decision to be in error.

(4) Data Release to State Agencies. The Council may release to state agencies Level 1 and Level 2 data for uses that promote the public interest; and Level 3 data as authorized by M.G.L. c. 6A, § 16K.

1. (a) Except as provided in 129 CMR 3.03(4)(e), a state agency must submit an application to the Data Release Review Board for data in compliance with the requirements of 129 CMR 3.02(b).
2. (b) Each agency shall enter into an interagency service agreement with the Council that allows for specifically approved purposes and uses within the public interest, provides for security and measures to safeguard the confidentiality of patient information, fulfills the applicable requirements set forth in 129 CMR 3.03(2)(b) and (c), and makes the required assurances set forth in 129 CMR 3.04(1).
3. (d) After an agency's initial request has been approved by the Board and an interagency service agreement has been executed, the Council may expedite subsequent data requests through a streamlined review process for additional agency projects or uses not stated in the original request.
4. (e) The Council will provide state agencies with public use files free of charge. The Council may charge a state agency that requests custom programming of the Council's datasets the actual cost incurred to fulfill the request. The Council will notify the agency of the estimated cost prior to fulfilling the request.

5. (f) Level 3 Data.

   1. 1. The Council may release Level 3 data to state agencies for purposes that promote the public interest as determined by the Council.
   2. 2. The Council shall provide the Division of Health Care Finance and Policy with the Level 3 Health Care Claims Data in accordance with the provisions of M.G.L. c. 6A, § 16K under an interagency service agreement for the purpose of conducting data analysis, preparing reports to assist in the formulation of health care policy and the provisions and purchase of health care services, and reviewing and evaluating mandated benefit proposals as required by M.G.L. c. 3, § 38C.