                                 CODE OF VIRGINIA

ALL-PAYER CLAIMS DATABASE CREATED; PURPOSE; REPORTING REQUIREMENTS (§
32.1-276.7:1)

A. The Virginia All-Payer Claims Database is hereby created to facilitate
data-driven, evidence-based improvements in access, quality, and cost of health
care and to promote and improve the public health through the understanding of
health care expenditure patterns and operation and performance of the health
care system.

B. The Commissioner shall ensure that the Department meets the requirements to
be a health oversight agency as defined in 45 C.F.R. &#xA7; 164.501.

C. The Commissioner, in cooperation with the Bureau of Insurance, shall collect
paid claims data for covered benefits from data suppliers, which shall include:

   1. Issuers of individual or group accident and sickness insurance policies
   providing hospital, medical and surgical, or major medical coverage on an
   expense-incurred basis; corporations providing individual or group accident
   and sickness subscription contracts; and health maintenance organizations
   providing a health care plan for health care services, for at least 1,000
   covered lives in the most recent calendar year;

   2. Third-party administrators and any other entities that receive or collect
   charges, contributions, or premiums for, or adjust or settle health care
   claims for, at least 1,000 Virginia covered lives on behalf of group health
   plans other than ERISA plans;

   3. Third-party administrators, and any other entities, that receive or collect
   charges, contributions, or premiums for, or adjust or settle health care
   claims for, an employer that maintains an ERISA plan that has opted-in to data
   submission to the All-Payer Claims Database pursuant to subsection P;

   4. The Department of Medical Assistance Services with respect to services
   provided under programs administered pursuant to Titles XIX and XXI of the
   Social Security Act;

   5. State government health insurance plans;

   6. Local government health insurance plans, subject to their ability to
   provide such data and to the extent permitted by state and federal law; and

   7. Federal health insurance plans, to the extent permitted by federal law,
   including Medicare, TRICARE, and the Federal Employees Health Benefits Plan.
   				Such collection of paid claims data for covered benefits shall not include
   data related to Medigap, disability income, workers&#8217; compensation
   claims, standard benefits provided by long-term care insurance, disease
   specific health insurance, dental or vision claims, or other supplemental
   health insurance products;

D. The Commissioner shall ensure that the nonprofit organization executes a
standard data submission and use agreement with each entity listed in subsection
B that submits paid claims data to the All-Payer Claims Database and each entity
that subscribes to data products and reports. Such agreements shall include
procedures for submission, collection, aggregation, and distribution of
specified data. Additionally, the Commissioner shall ensure that the nonprofit
organization:

   1. Protects patient privacy and data security pursuant to provisions of this
   chapter and state and federal privacy laws, including the federal Health
   Insurance Portability and Accountability Act (42 U.S.C. &#xA7; 1320d et seq.,
   as amended); Titles XIX and XXI of the Social Security Act; &#xA7;
   32.1-127.1:03; Chapter 6 (&#xA7; 38.2-600 et seq.) of Title 38.2; and the
   Health Information Technology for Economic and Clinical Health (HITECH) Act,
   as included in the American Recovery and Reinvestment Act (P.L. 111-5, 123
   Stat. 115) as if the nonprofit organization were covered by such laws;

   2. Identifies the type of paid claims to be collected by the All-Payer Claims
   Database and the entities that are subject to the submission of such claims as
   well as identification of specific data elements from existing claims systems
   to be submitted and collected, including but not limited to patient
   demographics, diagnosis and procedure codes, provider information, plan
   payments, member payment responsibility, and service dates;

   3. Administers the All-Payer Claims Database in a manner to allow for
   geographic, demographic, economic, and peer group comparisons;

   4. Develops public analyses identifying and comparing health plans by public
   and private health care purchasers, providers, employers, consumers, health
   plans, health insurers, and data analysts, health insurers, and providers with
   regard to their provision of safe, cost-effective, and high-quality health
   care services;

   5. Uses common data layout or other national data collection standards and
   methods that utilize a standard set of core data elements for data
   submissions, as adopted or endorsed by the APCD Council, to establish and
   maintain the database in a cost-effective manner and to facilitate uniformity
   among various all-payer claims databases of other states and specification of
   data fields to be included in the submitted claims, consistent with such
   national standards, allowing for exemptions when submitting entities do not
   collect the specified data or pay on a per-claim basis, such exemption process
   to be managed by the advisory committee created pursuant to subsection E;

   6. Does not disclose or report provider-specific, facility-specific, or
   carrier-specific reimbursement information, or information capable of being
   reverse-engineered, combined, or otherwise used to calculate or derive such
   reimbursement information, from the All-Payer Claims Database;

   7. Promotes the responsible use of claims data to improve health care value
   and preserve the integrity and utility of the All-Payer Claims Database; and

   8. Requires that all public reports and analyses comparing providers or health
   plans using data from the All-Payer Claims Database use national standards or,
   when such national standards are unavailable, provide full transparency to
   providers or health plans of the alternative methodology used.

E. The Commissioner shall establish an advisory committee to assist in the
formation and operation of the All-Payer Claims Database. Such committee shall
consist of (i) a representative from each of the following: a statewide hospital
association, a statewide association of health plans, a professional
organization representing physicians, a professional organization representing
pharmacists, an organization that processes insurance claims or certain aspects
of employee benefits plans for a separate entity, a community mental health
center who has experience in behavioral health data collection, a nursing home
health care provider who has experience with medical claims data, a nonprofit
health insurer, and a for-profit health insurer; (ii) up to two representatives
with a demonstrated record of advocating health care issues on behalf of
consumers; (iii) two representatives of hospitals or health systems; (iv) an
individual with academic experience in health care data and cost-efficiency
research; (v) a representative who is not a supplier or broker of health
insurance from small employers that purchase group health insurance for
employees; (vi) a representative who is not a supplier or broker of health
insurance from large employers that purchase health insurance for employees, and
(vii) a representative who is not a supplier or broker of health insurance from
self-insured employers, all of whom shall be appointed by the Commissioner. The
Commissioner, the chairman of the board of directors of the nonprofit
organization, the Commissioner of Insurance, the Director of the Department of
Medical Assistance Services, the Director of the Department of Human Resource
Management, or their designees, shall serve ex officio.
			In appointing members to the advisory committee, the Commissioner shall adopt
reasonable measures to select representatives in a manner that provides balanced
representation within and among the appointments and that any representative
appointed is without any actual or apparent conflict of interest, including
conflicts of interest created by virtue of the individual&#8217;s
employer&#8217;s corporate affiliations or ownership interests.
			The nonprofit organization shall provide the advisory committee with details
at least annually on the use and disclosure of All-Payer Claims Database data,
including reports developed by the nonprofit organization; details on methods
used to extract, transform, and load data; and efforts to protect patient
privacy and data security.
			The meetings of the advisory committee shall be open to the public.

F. The Commissioner shall establish a data release committee to review and
approve requests for access to data. The data release committee shall consist of
the Commissioner or his designee, and upon recommendation of the advisory
committee, the Commissioner shall appoint an individual with academic experience
in health care data and cost-efficiency research; a representative of a health
insurer; a health care practitioner; a representative from a hospital with a
background in administration, analytics, or research; and a representative with
a demonstrated record of advocating health care issues on behalf of consumers.
In making its recommendations, the advisory committee shall adopt reasonable
measures to select representatives in a manner that provides balanced
representation within and among the appointments and that any representative
appointed is without any actual or apparent conflict of interest, including
conflicts of interest created by virtue of the individual&#8217;s
employer&#8217;s corporate affiliations or ownership interests. The data release
committee shall ensure that (i) all data approvals are consistent with the
purposes of the All-Payer Claims Database as provided in subsection A; (ii) all
data approvals comply with applicable state and federal privacy laws and state
and federal laws regarding the exchange of price and cost information to protect
the confidentiality of the data and encourage a competitive marketplace for
health care services; and (iii) the level of detail, as provided in subsection
H, is appropriate for each request and is accompanied by a standardized data use
agreement.

G. The nonprofit organization shall implement the All-Payer Claims Database,
consistent with the provisions of this chapter, to include:

   1. The reporting of data that can be used to improve public health
   surveillance and population health, including reports on (i) injuries; (ii)
   chronic diseases, including but not limited to asthma, diabetes,
   cardiovascular disease, hypertension, arthritis, and cancer; (iii) health
   conditions of pregnant women, infants, and children; and (iv) geographic and
   demographic information for use in community health assessment, prevention
   education, and public health improvement. This data shall be developed in a
   format that allows comparison of information in the All-Payer Claims Database
   with other nationwide data programs and that allows employers to compare their
   employee health plans statewide and between and among regions of the
   Commonwealth and nationally.

   2. The reporting of data that payers, providers, and health care purchasers,
   including employers and consumers, may use to compare quality and efficiency
   of health care, including development of information on utilization patterns
   and information that permits comparison of health plans and providers
   statewide between and among regions of the Commonwealth. The advisory
   committee created pursuant to subsection E shall make recommendations to the
   nonprofit organization on the appropriate level of specificity of reported
   data in order to protect patient privacy and to accurately attribute services
   and resource utilization rates to providers.

   3. The reporting of data that permits design and evaluation of alternative
   delivery and payment models.

   4. The reporting and release of data consistent with the purposes of the
   All-Payer Claims Database as set forth in subsection A as determined to be
   appropriate by the data release committee created pursuant to subsection F.

H. Except as provided in subsection O, the nonprofit organization shall not
provide data or access to data without the approval of the data release
committee. Upon approval, the nonprofit organization may provide data or access
to data at levels of detail that may include (i) aggregate reports, which are
defined as data releases with all observation counts greater than 10; (ii)
de-identified data sets that meet the standard set forth in 45 C.F.R. &#xA7;
164.514(a); and (iii) limited data sets that comply with the National Institutes
of Health guidelines for release of personal health information.

I. Reporting of data shall not commence until such data has been processed and
verified at levels of accuracy consistent with existing nonprofit organization
data standards. Prior to public release of any report specifically naming any
provider or payer, or public reports in which an individual provider or payers
represents 60 percent or more of the data, the nonprofit organization shall
provide affected entities with notice of the pending report and allow for a
30-day period of review to ensure accuracy. During this period, affected
entities may seek explanations of results and correction of data that they prove
to be inaccurate. The nonprofit organization shall make these corrections prior
to any public release of the report. At the end of the review period, upon
completion of all necessary corrections, the report may be released. For the
purposes of this subsection, &#8220;public release&#8221; means the release of
any report to the general public and does not include the preparation of reports
for, or use of the All-Payer Claims Database by, organizations that have been
approved for access by the data release committee and have entered into written
agreements with the nonprofit organization.

J. The Commissioner and the nonprofit organization shall consider and recommend,
as appropriate, integration of new data sources into the All-Payer Claims
Database, based on the findings and recommendations of the advisory committee.

K. Information acquired pursuant to this section shall be confidential and shall
be exempt from disclosure by the Virginia Freedom of Information Act (&#xA7;
2.2-3700 et seq.). The reporting and release of data pursuant to this section
shall comply with all state and federal privacy laws and state and federal laws
regarding the exchange of price and cost information to protect the
confidentiality of the data and encourage a competitive marketplace for health
care services.

L. No person shall assess costs or charge a fee to any health care practitioner
related to formation or operation of the All-Payer Claims Database. However, a
reasonable fee may be charged to health care practitioners who voluntarily
access the All-Payer Claims Database for purposes other than data verification.

M. As used in this section, &#8220;provider&#8221; means a hospital or physician
as defined in this chapter or any other health care practitioner licensed,
certified, or authorized under state law to provide covered services represented
in claims reported pursuant to this section.

N. The Commissioner, in consultation with the board of directors of the
nonprofit organization, shall develop short-term and long-term funding
strategies for the operation of the All-Payer Claims Database to provide
necessary funding in excess of any budget appropriation by the Commonwealth.

O. The nonprofit organization, the Department of Health, the Department of
Medical Assistance Services, and the Bureau of Insurance shall have access to
data reported by the All-Payer Claims Database pursuant to this section at no
cost for the purposes of public health improvement research and activities.

P. Each employer that maintains an ERISA plan may opt-in to allow a third-party
administer or other entity to submit data to the All-Payer Claims Database. For
any such employer that opts-in, the third-party administrator or other entity
shall (i) submit data for the next reporting period after the opt-in and all
future reporting periods until the employer opts-out and (ii) include data from
any such employer as part of its data submission, if any, otherwise required by
this section. Such an employer may opt-out at any time but shall provide written
notice to the third-party administrator or other entity of its decision at least
30 days prior to the start of the next reporting period. No employer that
maintains an ERISA plan shall be required to opt-in to data submission to the
All-Payer Claims Database, and no third-party administrator or other entity
shall be required to submit claims processed before it was contracted to provide
services. Each third-party administrator or other entity providing claim
administration services for an employer shall submit annually to the nonprofit
organization by January 31 of each year a list of the ERISA plans whose employer
has opted-in to data submission to the All-Payer Claims Database and a list
identifying all employers that maintain an ERISA plan with Virginia employees
for which it provides claim administration services. Such information submitted
shall be considered proprietary and shall be exempt from disclosure by the
Virginia Freedom of Information Act (&#xA7; 2.2-3700 et seq.).

Q. Any data release shall make use of a masked proxy reimbursement amount, for
which the methodology is publicly available and approved by the data release
committee except that the Department may request that the nonprofit organization
generate the following reports based on actual reimbursement amounts: (i) the
total cost burden of a disease, chronic disease, injury, or health condition
across the state, health planning region, health planning district, county, or
city, provided that the total cost shall be an aggregate amount encompassing
costs attributable to all data suppliers and not identifying or attributable to
any individual provider, and (ii) any analyses to determine the average
reimbursement that is paid for health care services that may include inpatient
and outpatient diagnostic services, surgical services or the treatment of
certain conditions or diseases. Any additional report of analysis based on
actual reimbursement amounts shall require the approval of the data release
committee.

R. The nonprofit organization shall ensure the timely reporting of information
by private data suppliers to meet the requirements of this section. The
nonprofit organization shall notify private data suppliers of any applicable
reporting deadlines. The nonprofit shall notify, in writing, a private data
supplier of a failure to meet a reporting deadline, and that failure to respond
within two weeks following receipt of the written notice may result in a
penalty. The Board may assess a civil penalty of up to $1,000 per week per
violation, not to exceed a total of $50,000 per violation, against a private
data supplier that fails, within its determination, to make a good faith effort
to provide the requested information within two weeks following receipt of the
written notice required by this subsection. Civil penalties assessed under this
subsection shall be maintained by the Department and used for the ongoing
improvement of the All-Payer Claims Database.

HISTORY: 2012, cc. 693, 709; 2019, cc. 672, 673.