80-007 Code Vt. R. 80-280-007-X - RULE 9.000: DATA RELEASE

9.100 GENERAL PROVISIONS

9.101 Authority.

The Board adopts this Rule pursuant to 18 V.S.A. §§ 9404 and 9410.

9.102 Purpose.

The Green Mountain Care Board ("Board" or "GMCB") stewards two data sets (collectively "the health care database"). The Vermont Health Care Uniform Reporting and Evaluation System ("VHCURES") data set contains information related to health care utilization, costs, and resources provided in Vermont and to Vermont residents in other states. The Vermont Uniform Hospital Discharge Data Set ("VUHDDS") contains information related to health care provided to patients at health care facilities in Vermont and health care provided to Vermont residents at health care facilities in other states.

Subject to certain restrictions and limitations, the Board makes some of the information in the health care database available as a resource for individuals and entities to review health care utilization, expenditures, and performance in Vermont. This rule establishes processes by which the Board will make data in the health care database available to support legitimate and beneficial research and analysis.

9.103 Definitions.

For purposes of this rule:

(1) "Analytic table" means a file developed to answer specialized questions with detailed information related to claims, patients, health insurers, or health care providers.

(2) "Authorized User" means a person authorized by the Board to access restricted data under the terms of a data use agreement.

(3) "Board" or "GMCB" means the Green Mountain Care Board established in Title 18, Chapter 220 of the Vermont Statutes Annotated, the Board's staff, or other designee of the Board.

(4) "Council Chair" means the chair of the Data Governance Council.

(5) "Data Governance Council" or "Council" means the committee established by the Board and given responsibilities for the Board's data governance program.

(6) "Data set" means a collection of logical individual data records, regardless of format.

(7) "Data use agreement" or "DUA" means a written agreement detailing an Authorized User's commitment to data privacy and security and setting forth restrictions, limitations, and conditions on the use and disclosure of data from the health care database.

(8) "Data Use and Disclosure Manuals" means the publicly available manuals created and maintained by the Board that specify procedures for the submission and review of applications for data from the VHCURES and VUHDDS data sets, limitations on the availability of such data, and requirements that persons seeking or receiving such data must comply with to ensure that the privacy and security of the data is maintained.

(9) "Data Release Schedules" means the documents created and maintained by the Board that classify data elements based on the risk that release would pose for identification of individuals and disclosure of proprietary or other sensitive information.

(10) "Health care database" means the VHCURES and VUHDDS data sets, collectively.

(11) "Health care facility" has the same meaning as in 18 V.S.A. § 9432(8).

(12) "Health care provider" has the same meaning as in 18 V.S.A. § 9432(9).

(13) "Health insurer" has the same meaning as in 18 V.S.A. § 9410(j)(1).

(14) "Individual user affidavit" means the form created and maintained by the Board for Principal Investigators and any individual who will be allowed to access data under a DUA acknowledge and affirm that they have read, understand, and agree to abide by the DUA's terms and conditions.

(15) "Insured" has the same meaning as in 18 V.S.A. § 9418(a)(10).

(16) "Limited data set" has the same meaning as in 45 C.F.R. § 164.514(e)(2).

(17) "Member" means the insured subscriber and any other person(s) eligible for health care benefits under the subscriber's policy, such as the subscriber's spouse or dependent.

(18) "Patient" means any person in a data set that is the subject of the activities of the claim performed by the health care provider.

(19) "Person" means any natural person, business entity, municipality, the State of Vermont or any department, agency, or subdivision of the State, and any partnership, unincorporated association, or other legal entity.

(20) "Principal Investigator" means the individual designated by an Authorized User to be responsible for ensuring compliance with the requirements in a DUA. An Authorized User may also be a Principal Investigator.

(21) "Secure Analytic Environment" or "SAE" means a secure, virtual remote desktop, server, or other portal that provides access to restricted data in a data set through individual accounts provided to Authorized Users as specified in their Individual User Affidavit.

(22) "Standard report" means a recurring report derived from the VHCURES or VUHDDS data sets that is intended to provide information pertaining to claims, members, patients, health insurers, health insurance, health care providers, and/or health care services.

(23) "Subscriber" means the individual responsible for payment of premiums or whose employment, income, or other circumstances is the basis for eligibility for membership in a health benefit plan.

(24) "Vermont Health Care Uniform Reporting and Evaluation System" or "VHCURES" means the data set containing information related to eligibility, health care claims, and related data submitted by health care insurers to the GMCB.

(25) "Vermont Uniform Hospital Discharge Data Set" or "VUHDDS" means the data set consisting of inpatient discharge data, outpatient procedures and services data, and emergency department data submitted by general hospitals, ambulatory surgery centers, and psychiatric hospitals that is maintained by the Vermont Department of Health.

9.200 RELEASE OF DATA

9.201 Availability of Data in the Health Care Database.

(a) The Data Release Schedules shall classify data elements in the health care database as "unrestricted," "restricted," or "unavailable" based on the level of risk that release of the data would pose for identification of individuals and disclosure of proprietary or other sensitive information.

(b)

(1) Data elements classified as "unrestricted" may be available for general use and public release under section 9.203 of this rule.

(2) Data elements classified as "restricted" shall not be available for use or release outside the Board unless permitted under the terms of an executed DUA.

(3) Data elements classified as "unavailable," including any data element not classified as unrestricted or restricted, shall not be available for use or release outside the Board in any circumstance.

(c) The Data Use and Disclosure Manuals may specify additional restrictions or limitations on the availability of data in the health care database, such as restrictions or limitations required by the agreements under which the Board obtains the data and the laws that apply to the data.

9.202 Modes of Access; Secure Analytic Environment.

(a) Persons with access to VHCURES or VUHDDS data sets may receive extracts generated from the data or permission to access the data set through the Secure Analytic Environment.

(b) No person outside the Board may access the Secure Analytic Environment unless permitted under the terms of an executed DUA.

9.203 Release of Public Use Data, Analytic Tables, and Standard Reports.

(a) If beneficial to the public, usable, and technically feasible, the Board may from time to time publish unrestricted data elements and information derived from unrestricted data elements in public use data files, analytic tables, or standard reports.

(b) Public use data files, analytic tables, and standard reports published under subsection (a) of this section shall:

(1) be made available upon request for no or minimal cost by Web-based electronic data download; and

(2) contain clear and conspicuous explanations of the characteristics of the data, such as the dates of the data contained in the files, the absence of costs of care for uninsured patients or nonresidents, underlying methodology, and other disclaimers that provide appropriate context.

9.300 DATA USE AGREEMENTS; APPLICATION AND REVIEW

9.301 Application.

(a) A person may request authorization to access the Secure Analytic Environment or data sets or analytic tables that include restricted data elements by applying for a limited data set on forms maintained by the Board.

(b) The Board may require a prospective applicant for access to the Secure Analytic Environment or data sets or analytic tables that include restricted data elements to complete and submit a pre-application review form.

(c) The Board will create and maintain one or more Data Use and Disclosure Manuals that specify procedures for the submission and review of applications. The Board's procedures may require review and approval of applications by agencies other than the Board and may specify different procedures for different types of requests and requestors.

9.302 Review of Applications.

(a) The Data Governance Council shall approve or deny applications submitted under section 9.301(a) of this rule on behalf of the Board. The Council shall solicit and consider public comment relating to applications.

(b) The Data Governance Council may approve applications submitted under section 9.301(a) of this rule only when satisfied as to the following:

(1) The application submitted to the Council is complete and has been signed by the Principal Investigator(s) and a person with authority to bind the applicant, or, if the applicant is an individual, by the individual;

(2) Procedures to ensure the confidentiality of any patient data or other confidential data are documented;

(3) The qualifications of the investigators and staff, as evidenced by:

(A) credentials, training and previous research; and

(B) an affiliation with a university, private research organization, health care facility, state agency, or other qualified institutional entity;

(4) No state or federal law or regulation prohibits release of the requested information; and

(5) The data will be used in a way that aligns with GMCB's statutory responsibilities; federal and state data protection and privacy requirements; and the data stewardship policies adopted and amended from time to time by the Data Governance Council, which the Board shall make available on its website.

(c) If the Council denies an application submitted under section 9.301(a) of this rule, it shall give written notice of the basis for denial and give the applicant an opportunity to resubmit or supplement the application to address the Council's concerns. Any adverse decision regarding an application made by or on behalf of the Council may be appealed to the Board within 30 days by filing a notice of appeal to the Chair of the Board.

(d) A decision by the Board to deny an appeal filed under subsection (c) of this section shall be a final decision that is appealable pursuant to 18 V.S.A. § 9381.

9.303 Data Use Agreements.

(a) To access the Secure Analytic Environment or data sets or analytic tables that include restricted data elements, an Authorized User and Principal Investigator must execute a data use agreement with the Board.

(b) The Board will create and maintain standard data use agreements that set forth the restrictions, limitations, and conditions on the use and disclosure of data from the health care database.

(c) The Principal Investigator and any individual who will be allowed to access data under a DUA must sign an individual user affidavit.

(d) An Authorized User and the Principal Investigator must comply with the terms of the DUA. Failure to do so will be cause for immediate recall of the data or revocation of permission to use the data and may be grounds for sanctions under section 9.601 of this rule.

9.400 COSTS OF DATA AND SERVICES

9.401 Analytic and Information Services.

Upon request, the Board or its designated vendor may provide analytic and information services for members of the public.

9.402 Costs and Fees.

(a) Data sets containing restricted data elements approved for release under this rule shall be made available to an Authorized User at the cost charged by the Board's designated vendor to program and process the requested data set. An Authorized User must pay these costs directly to the designated vendor within thirty days of receipt of the data set.

(b) Access to the Secure Analytic Environment access will be provided to an Authorized User at the cost charged by the Board's designated vendor. An Authorized User must pay these costs directly to the designated vendor prior to receiving access to the SAE.

(c) Analytic tables approved for release under this rule and analytic and information services shall be made available at the maximum allowable rate under law for time spent extracting data and performing similar tasks necessary to create the table or provide the services. Payments are due within thirty days of receipt of the analytic tables or receipt of an invoice for the analytic or information services.

9.403 Cost and Fee Waivers.

Subject to budgetary limitations of the Board, the Data Governance Council may grant full or partial cost or fee waivers or may enter into alternative payment arrangements with applicants who can demonstrate that:

(1) the requested data will be used to fulfill a public purpose, and

(2) the payment of the costs or fees would constitute an undue financial hardship. Costs and fees shall be waived for any department, agency, or subdivision of the State of Vermont.

9.500 SPECIAL CONSIDERATIONS

9.501 Data Linkage.

(a) No person outside the Board may link VHCURES or VUHDDS data, including public use data, with any data sources containing personally identifiable information or other data sources that could result in the identification of individuals in the data set without the express written consent of the Board. For purposes of this section, data linkage means the merging of two or more unique data sets or files to connect common identifiers across the data sets.

(b) If necessary to conduct research that would otherwise not be practicable, a person may request authorization to link VHCURES or VUHDDS data with identifiable record data sources using forms created and maintained by the Board. Requestors must provide a list of data sources to which the data would be linked and identify which data sources include personally identifiable information, including the specific identifiers within those data sources, as well as any other information specified by the Board.

(c) Any data set linked to VHCURES or VUHDDS data must, at a minimum, adhere to the protections, constraints and requirements set forth in the underlying GMCB data use agreement.

(d) If the Board denies a data linkage request, it shall provide a written explanation to the requestor identifying reasons for the denial.

9.502 Data Redisclosure.

(a) An Authorized User may not redisclose VHCURES or VUHDDS data or extracts generated from the data to third parties or external agents such as contractors, subcontractors, grantees, and subgrantees without the express written approval of the Board or the Council.

(b) An Authorized User may request authorization to redisclose VHCURES or VUHDDS data. Requestors must provide a full list of individuals who will have access to the data upon the effective date of an approved redisclosure and assurances that the recipient of the redisclosed data will be bound by a written agreement to the same restrictions and conditions that apply to the Authorized User under its DUA with the Board. Requests for redisclosure can be made as part of an application under section 9.301(b) of this rule.

(c) The Principal Investigator(s) identified in the Board's DUA with the Authorized User shall ensure that individual user affidavits are submitted to the Board for all data users prior to granting access to VHCURES or VUHDDS data under a redisclosure.

9.600 ENFORCEMENT

9.601 Sanctions for Violations.

(a) A person who knowingly fails to comply with the requirements of 18 V.S.A. § 9410 or this rule may be subject to sanction by the Board as set out in 18 V.S.A. § 9410(g) after written notice and an opportunity to be heard. The Board's authority to sanction individuals shall be in addition to any other powers granted to the Board to investigate, subpoena, or seek other legal or equitable remedies, including the power of the Board to enforce the terms of a DUA.

(b) Hearings under this section shall be conducted by the Board in accordance with 3 V.S.A. §§ 809, 809a, 809b, and 810. Decisions of the Board under this section shall comply with the requirements of 3 V.S.A. § 812 and may be appealed pursuant to 18 V.S.A. § 9381.

9.700 OTHER MATTERS

9.701 Waiver of Rules.

In order to prevent unnecessary hardship or delay, in order to prevent injustice, or for other good cause, the Board may waive the application of any provision of this rule upon such conditions as it may require, unless precluded by the rule itself or by statute.

9.702 Conflict.

In the event this rule or any section thereof conflicts with a Vermont statute or a federal statute, rule, or regulation, the Vermont statute or federal statute, rule, or regulation shall govern.

9.703 Severability.

If any provision of this regulation or the application thereof to any person or circumstance is for any reason held to be invalid, the remainder of the regulation and the application of such provisions to other persons or circumstances shall be not affected thereby.

9.704 Effective Date.

This rule shall become effective fifteen (15) days after adoption.

Notes

80-007 Code Vt. R. 80-280-007-X

EFFECTIVE DATE:
1/20/2022 Secretary of State Rule Log #22-002

STATUTORY AUTHORITY:

18 V.S.A. §§ 9404 and 9410.