Medicare Program; Contract Year 2027 and Certain Contract Year 2026 Policy and Technical Changes to the Medicare Advantage Program, Medicare Prescription Drug Benefit Program, and Medicare Cost Plan Program

Section 1853(a) of the Act requires CMS to risk adjust payments made to Medicare Advantage (MA) organizations. In order to carry out risk adjustment, section 1853(a)(3)(B) of the Act requires MA organizations to submit data regarding inpatient hospital services and data regarding other services and other information the Secretary deems necessary. Risk adjustment data are the data submitted to CMS by MA organizations to carry out risk adjustment, including the development and application of a risk adjustment payment model. Regulations at 42 CFR 422.310 establish requirements regarding the collection and submission of risk adjustment data, as well as the allowable uses of risk adjustment data and conditions under which the data can be released.

The MA program now comprises more than 50 percent of the Medicare population, and there has been a coinciding increase in the number and variety of requests that CMS receives for risk adjustment data. This increase is due to both the utility of the more detailed risk adjustment data that CMS started collecting in 2012 (that is, encounter data) and growing enrollment in MA. With the increased variety of requests for risk adjustment data and CMS's better understanding of the data requests received, CMS has come to recognize that the limits on the use and release of risk adjustment data imposed by Sec. 422.310(f) may be unnecessary, burdensome, and overly restrictive for CMS, and for private and public stakeholders requesting the data. The existing restrictions may limit innovative uses of the data by CMS and non-CMS entities that may improve program integrity, increase efficiency, and reduce waste. The changes to the use and release regulations described in section IV.C of the proposed rule would lead to more efficient use of public and private sector resources by removing the existing restrictions on the use and release of risk adjustment data while maintaining the protections in place for beneficiary identifying information through CMS data sharing procedures and for plan-submitted dollar amounts reported for an associated encounter. CMS believes that easing the use and release requirements for risk adjustment data would support the goals of Executive Order 14243 “Stopping Waste, Fraud, and Abuse by Eliminating Information Silos” (March 20, 2025) by reducing barriers to sharing government data across agencies, improve CMS's ability to effectively and efficiently administer and oversee MA and other Federal health care programs, as well as encourage research into improving health care delivery. 1. Background

Section 1853(a) of the Act requires the Secretary to make monthly payments to MA organizations for each beneficiary enrolled in an MA plan. Section 1853(a)(1)(C) of the Act requires the Secretary to adjust the monthly payments based on risk factors of a plan's enrolled beneficiaries, such as demographic factors and other factors

that the Secretary determines are appropriate, including health status. To support risk adjustment, section 1853(a)(3)(B) of the Act requires MA organizations to submit data regarding the services provided to enrollees and other information the Secretary deems necessary.

The requirements for the submission of risk adjustment data by MA organizations are set forth at Sec. 422.310. In accordance with these regulations, MA organizations must submit the data necessary to characterize the context and purposes of each item and service provided to their enrollees by a provider, supplier, physician, or other practitioner in accordance with CMS instruction. Paragraphs (a) through (d) of Sec. 422.310 define risk adjustment data, the basic rules of risk adjustment data collection, the sources and extent of risk adjustment data, and other risk adjustment data requirements. There are two forms of risk adjustment data: (1) data equivalent to Medicare fee- for-service (FFS) data, hereafter referred to as Original Medicare (OM) data, when appropriate, and to all relevant national standards, referred to as encounter data, and (2) data submitted by MA organizations prior to 2022 in an abbreviated format, referred to as Risk Adjustment Processing System (RAPS) data.\38\ \39\ Both encounter data and RAPS data submissions include beneficiary diagnoses.

\38\ Refer to the CSSC Operations website for information about the submission of encounter data and RAPS data.

\39\ RAPS remains available to MA organizations for the submission of data corrections for years prior to 2022.

Though section 1853(a)(3)(B) of the Act does not limit the Secretary's use or disclosure of risk adjustment data, Federal laws, such as the Privacy Act of 1974 (as amended), impose restrictions on the disclosure of data collected by Federal agencies, and section 1106(a) of the Act [42 U.S.C. 1306(a)] generally prohibits the disclosure of any information obtained by HHS except as the Secretary may prescribe by regulations and except as otherwise provided by Federal law. Over time, CMS has regulated the scope of permissible uses and releases of the MA risk adjustment data, including RAPS and encounter data, in order to achieve a balance between protection of beneficiary identifying information and the interests of MA organizations with the need to effectively administer Federal programs and to encourage research into better ways to provide health care. In the final rule establishing the MA program, published in January 2005 (70 FR 4661), CMS adopted regulations at Sec. 422.310(f) such that CMS may use risk adjustment data to determine the risk adjustment factor used to adjust payments, and for unspecified other purposes, with an exception made to limit CMS's use of medical record data collected under Sec. 422.310(e) to validation studies.

In April 2008, CMS proposed to amend Sec. 422.310 to provide that CMS will collect data from MA organizations regarding each item and service provided to an MA plan enrollee,\40\ which would allow CMS to include utilization data and other factors in developing CMS- Hierarchical Condition Categories (CMS-HCC) risk adjustment models that reflect patterns of diagnoses and expenditures in the MA program. In response to the April 2008 proposal and CMS's efforts to collect encounter data, some stakeholders raised concerns that the use of risk adjustment data for “other purposes,” as finalized in the January 2005 final rule, was too broad. Some stakeholders also believed that the data collected for risk adjustment, including encounter data, could not be used for purposes other than risk adjustment. CMS disagreed with this assertion. As stated in the August 2008 final rule, “Section 1853(a)(3)(B) of the Act obligates MA organizations to submit inpatient and outpatient encounter data for purposes of use in implementing a risk adjustment methodology. Unlike the case of information collected under section 1860D-15 of the Act, however, which the statute restricts to being used solely for purposes of implementing that section (see section 1860D-15(d)(2)(B) and (f)(2) of the Act), section 1853(a)(3)(B) of the Act does not impose any such restrictions on other legitimate uses of the encounter data collected” (73 FR 48653). While CMS is not subject to specific statutory restrictions on our own use of risk adjustment data, the agency responded to industry concerns by establishing regulatory limits on the agency's use of risk adjustment data. Specifically, in the August 2008 final rule, CMS revised Sec. 422.310(f) to establish the following five specific uses of risk adjustment data: (i) calculating the risk adjustment factors used to adjust payments, (ii) updating risk adjustment models, (iii) calculating Medicare Disproportionate Share Hospital (DSH) percentages, (iv) conducting quality review and improvement activities, and (v) for Medicare coverage purposes (73 FR 48651, 48653-48654).

\40\ Refer to Federal Register, 73 FR 23528, section H: https://www.federalregister.gov/documents/2008/04/30/08-1135/medicare-program-proposed-changes-to-the-hospital-inpatient-prospective-payment-systems-and-fiscal.

CMS made further revisions to Sec. 422.310(f) in the August 2014 final rule to strengthen program management and increase transparency in the MA program by adding four more uses of risk adjustment data at Sec. 422.310(f)(1)(vi) through Sec. 422.310(f)(1)(ix) and by adding two subparagraphs Sec. 422.310(f)(2) and Sec. 422.310(f)(3) to address the terms under which risk adjustment data could be released to non-CMS entities (79 FR 50324-50334). Specifically, the four uses added to Sec. 422.310(f)(1) in the August 2014 final rule are: (vi) to conduct evaluations and other analysis to support the Medicare program (including demonstrations) and to support public health initiatives and other health care-related research; (vii) for activities to support the administration of the Medicare program; (viii) for activities conducted to support program integrity; and (ix) for purposes authorized by other applicable laws.

The subparagraph CMS added in the August 2014 final rule at Sec. 422.310(f)(2) provided that the agency may release the minimum data it determines is necessary for one of the purposes listed in Sec. 422.310(f)(1) to other HHS agencies, other Federal executive branch agencies, States, and external entities where that disclosure would be in accordance with: (i) applicable Federal laws; (ii) CMS data sharing procedures; (iii) subject to the protection of beneficiary identifier elements and beneficiary confidentiality, (iv) subject to the aggregation of dollar amounts reported for the associated encounter to protect commercially sensitive data; and (v) risk adjustment data other than that described in paragraphs (f)(2)(iii) and (f)(2)(iv) of Sec. 422.310 will be released without the redaction or aggregation described in paragraphs (f)(2)(iii) and (f)(2)(iv), respectively. CMS clarified that an external entity could be an individual, a group, or an organization, and that CMS would not release payment data (that is, dollar amounts) submitted by MA organizations at the level of the encounter as that data might reveal proprietary negotiated payment rates between MA plans and providers (79 FR 50328).

The subparagraph CMS added at (f)(3) in the August 2014 final rule stipulates additional conditions related to the timing of release of risk adjustment data in response to comments from some stakeholders that there should be a delay in releasing the data. CMS added subparagraph (f)(3) in response to comments to clarify that CMS did not plan to regularly release risk adjustment

data for a data collection year prior to the completion of the reconciliation period. Risk adjustment reconciliation refers to the period provided to MA organizations to identify and correct errors in data they have submitted for a data collection year to ensure that the risk adjustment data is complete and accurate based on the MA organization's best knowledge, information, and belief. Risk adjustment data are not considered reconciled for a given payment year until after the final risk adjustment data submission deadline, established at Sec. 422.310(g)(2)(ii), which can be no earlier than January 31 of the year following the payment year (for example, January 31, 2025, for payment year 2024). Specifically, Sec. 422.310(f)(3)(i) specifies that risk adjustment data submitted for a given payment year are not available for release by CMS unless the risk adjustment reconciliation has been completed for that payment year except under limited circumstances, such as when CMS determines that releasing risk adjustment data before reconciliation is necessary for emergency preparedness (Sec. 422.310(f)(3)(ii)) or due to extraordinary circumstances (Sec. 422.310(f)(3)(iii)) (79 FR 50331).

Since the August 2014 final rule was published, CMS has identified additional circumstances that warranted releasing risk adjustment data prior to reconciliation outside of emergency preparedness and extraordinary circumstances. In the final rule issued in November 2023, CMS provided an additional circumstance (Sec. 422.310(f)(3)(iv)) to allow for releasing aggregate risk adjustment data prior to risk adjustment reconciliation (88 FR 79397-79400). This provision was added to provide MA utilization data measures on the Care Compare website, along with OM utilization data, to support the administration of the Medicare program and to more completely fulfill the public reporting required by section 104 of the Medicare Access and CHIP Reauthorization Act (MACRA) and section 10331 of the Patient Protection and Affordable Care Act of 2010 (Pub. L. 111-148) (Affordable Care Act) and provide beneficiaries with useful and appropriate information when selecting a Medicare provider.

The following year, in April 2024, CMS issued a final rule in which CMS revised two of the allowable uses (Sec. 422.310(f)(1)(vi) and (vii)) to support the administration of the Medicaid program as well as the Medicare program. CMS further allowed for the release of risk adjustment data to State Medicaid agencies before reconciliation for the specific purpose of coordinating care for dually eligible individuals if CMS determined it was necessary and appropriate to support the administration of the Medicare and Medicaid programs (Sec. 422.310(f)(3)(v)) (89 FR 30536-30541). This expansion of CMS's use of risk adjustment data to support the administration of the Medicaid program is consistent with the goals of better integrating benefits and improving care coordination for dually eligible individuals as established at section 2602 of the Affordable Care Act. 2. Overview of Proposed Regulatory Changes

CMS proposed to increase access to risk adjustment data while reducing regulatory burden and the resources expended by public and private organizations when requesting risk adjustment data by removing the uses enumerated in Sec. 422.310(f)(1). This change would enable CMS to align more closely with standards applicable to OM claims and other MA and Part D data and allow the data to be used for more purposes than are permitted under the existing regulations. CMS receives requests to use risk adjustment data for a broad range of purposes including research, health care operations, and oversight of public benefit programs, and from a broad range of entities including academic institutions, government entities, and oversight bodies. CMS believes the limitations imposed by Sec. 422.310(f)(1) may be excessive and does not think that MA risk adjustment data should have a different or more restrictive standard for use and release than the standard applied to Medicare OM claims. Similarly, the list of external parties to whom the data can be released at Sec. 422.310(f)(2) (“other HHS agencies, other Federal executive branch agencies, States, and external entities”) may unnecessarily limit access to risk adjustment data to some external entities for legitimate uses that are in the public's interest. CMS believes the proposed removal of Sec. 422.310(f)(2), which would eliminate the restriction on which types of entities can access the data, would be in keeping with our approach to make the risk adjustment data more broadly available. CMS also believes that the provisions on the timing of release of risk adjustment data at Sec. 422.310(f)(3) may be overly restrictive, and there should be more flexibility to release data before reconciliation.

We emphasize, however, that CMS release of the data would remain contingent on Federal law and CMS data sharing procedures, per the proposal at Sec. 422.310(f). CMS data sharing procedures include an evaluation of requests to ensure that data requests comply with applicable Federal laws, regulations, and CMS data policies. Additionally, as part of the request process, unless the requester is a beneficiary requesting his or her own data, a data sharing agreement is required to be established between CMS and the requesters prior to disclosing the data. Data sharing agreements include, but are not limited to, information exchange agreements (IEA),\41\ memoranda of understanding (MOU), and data use agreements (DUAs),\42\ all of which are agreements that document the terms and conditions under which CMS data may be used to ensure that data requesters adhere to CMS privacy and security requirements and data release policies. Included in the terms and conditions are safeguards to protect beneficiary identifying information and confidentiality. Also, consistent with what we stated in the August 2014 final rule, CMS data sharing agreements have enforcement mechanisms, and data requesters are required to acknowledge these mechanisms. For example, penalties under section 1106(a) of the Act [42 U.S.C. 1306(a)], including possible fines or imprisonment, and criminal penalties under the Privacy Act [5 U.S.C. 552a(i)(3)] may apply, as well as criminal penalties imposed under 18 U.S.C. 641 (79 FR 50333). Requesters of CMS data are responsible for abiding by the law, policies, and restrictions of the data sharing agreements.

\41\ Centers for Medicare & Medicaid Services. (n.d). CMS Information Exchange Agreement (IEA). U.S. Department of Health and Human Services. https://security.cms.gov/learn/cms-information-exchange-agreement-iea.

\42\ Centers for Medicare & Medicaid Services. (n.d.). CMS data: Data disclosures and data use agreements (DUAs). U.S. Department of Health and Human Services. https://www.cms.gov/data-research/cms-data/data-disclosures-and-data-use-agreements-duas. An example of a research DUA can be found on the ResDAC website at https://resdac.org/request-form/rif-data-use-agreement.

Over time, Sec. 422.310(f) has become increasingly complex and cumbersome to implement as CMS receives more requests and identifies additional reasonable uses that CMS did not anticipate. As described previously, CMS has revised the regulation over the years by adding specific uses or exceptions for release of risk adjustment data as they are identified, which is burdensome, slows progress, and limits opportunities to effectively and efficiently administer, oversee, and improve Federal programs, and to conduct health care research that can

improve health care delivery. As outlined in section IV.C of the proposed rule, we address these concerns by easing restrictions on the use and release of risk adjustment data while maintaining the current protections for plan-submitted payment amounts for an associated encounter that are currently in place. Protections for beneficiary identifying information currently specified in regulation would be maintained through CMS data sharing procedures and other applicable Federal laws as described previously.

CMS expects that transparency in the MA program will be improved by removing: (1) the specific uses at Sec. 422.310(f)(1), aside from protections of the plan-submitted payment amounts that currently exist; (2) the restrictive conditions regarding which external government entities the data can be released to at Sec. 422.310(f)(2); and (3) the timing of when the data can be released at Sec. 422.310(f)(3). We believe these revisions will also allow for more streamlined access to information on the Medicare program as MA grows, thereby strengthening program management, continuing to advance program integrity, supporting public health initiatives, and reducing burden through the implementation of practices and processes for the use and release of MA risk adjustment data that align more closely with standards applicable to other Medicare data, such as OM claims. The revisions to Sec. 422.310(f) are consistent with Executive Order 14192 “Unleashing Prosperity through Deregulation” (January 31, 2025) by reducing the burden for CMS and external entities associated with the increasingly complex regulation surrounding the use and release of risk adjustment data and would support the goals of Executive Order 14243 “Stopping Waste, Fraud, and Abuse by Eliminating Information Silos” (March 20, 2025) by reducing barriers to sharing government data across agencies. 3. Broadening of the Use and Release of Risk Adjustment Data

CMS proposed to ease restrictions on the use of risk adjustment data at Sec. 422.310(f)(1) and repeal the limitations surrounding the release of risk adjustment data at Sec. 422.310(f)(2) and (f)(3), other than the protections currently in place for plan-submitted payment amounts, to allow for the use and release of risk adjustment data that is more aligned with the use and release of OM claims and other MA data. The limited uses of risk adjustment data were established when CMS resumed activities to collect encounter data to alleviate concerns from some stakeholders that risk adjustment data would be used in ways that they thought were inappropriate. As stated previously, CMS does not believe the statute restricts our use of risk adjustment data, and over time CMS has identified unanticipated uses and releases of the data that are in the public's interest beyond the nine listed at Sec. 422.310(f)(1). Historically, this has necessitated CMS resources to conduct rulemaking to add to or amend the list, resulting in regulatory burden and increasingly complex requirements. For example, as previously discussed, CMS could not use risk adjustment data to conduct evaluations and other analyses to support the Medicaid program, nor could CMS use the data to support the administration of the Medicaid program, like care coordination, before amending Sec. 422.310(f)(1)(vi) and (vii) in the final rule CMS issued in April 2024 (89 FR 30536 through 30541).

Given the growth of MA, risk adjustment data is increasingly important to understanding the Medicare program and health care delivery more broadly. CMS anticipates that the number and variety of requests for risk adjustment data will continue to increase, as will the resources required to enforce the more restrictive requirements and to develop revised regulations when unanticipated yet warranted uses are identified. We believe that removing the specified uses and easing restrictions for data release at Sec. 422.310(f) would provide CMS flexibility to release MA risk adjustment data in a way that more closely aligns with the release of OM claims and other MA data, which is crucial to burden reduction and the ability of CMS and external entities to be innovative in the pursuit of improved health care delivery and program integrity, greater transparency, and reduced fraud, waste, and abuse.

Specifically, CMS proposed to revise Sec. 422.310(f) as follows: “Regarding the data described in paragraphs (a) through (d) of this section, CMS may use and release the minimum data it determines is necessary in accordance with CMS data sharing procedures and applicable Federal laws, subject to the aggregation of dollar amounts reported for the associated encounter to protect commercially sensitive data, unless authorized by other applicable laws.” The updates provide for the stipulation that this regulation does not limit CMS disclosure of data as authorized under separate statutory authority.\43\ We proposed to repeal the nine specified uses currently listed in Sec. 422.310(f)(1) that would be encompassed under the revised paragraph (f) text. We also proposed to repeal the release restrictions specified at Sec. 422.310(f)(2) and Sec. 422.310(f)(3), other than the existing restrictions on the release of the minimum data necessary and on the release of dollar amounts at the encounter level, which were moved to Sec. 422.310(f). We noted in the proposed rule, however, that protections to the beneficiary identifying information would be encompassed under the data sharing procedures in the revised paragraph (f) text.

\43\ For example, 31 U.S.C. 716, 2 U.S.C. 166(d)(1) and 601(d), section 1805 of the Act (42 U.S.C. 1395b-6), section 1128J of the Act (42 U.S.C. 1320a-7k), and section 6(a) of the Inspector General Act of 1978 (5 U.S.C. 406).

Though CMS proposed to repeal the regulatory language at Sec. 422.310(f)(2) that stipulates protections for beneficiary confidentiality, the protections of beneficiary identifying information currently specified at Sec. 422.310(f)(2) would remain in place in accordance with applicable Federal laws, such as the Privacy Act, section 1106(a) of the Act, and CMS information disclosure regulations at 42 CFR part 401, subpart B, that continue to govern this data sharing. CMS would be able to release an individual's risk adjustment data when authorized by that individual and, for other kinds of requests for release of risk adjustment data, CMS would release such information in accordance with CMS data sharing procedures, consistent with current practice. We intend to continue to protect beneficiary data through, for example, encryption, or removal of the confidential fields when risk adjustment data is released. CMS has an established process to evaluate requests for data and enters into data sharing agreements with data requesters for disclosures of risk adjustment data to ensure that data requesters adhere to CMS privacy and security requirements and data release policies. We believe this process contains the necessary checks and safeguards to ensure that the risks of disclosure of beneficiary identifying information are minimal.

In the Contract Year 2027 proposed rule, CMS discussed maintaining the protections that currently exist regarding the release of plan- submitted dollar amounts associated with the items or services submitted to CMS pursuant to Sec. 422.310(b) that characterize the context and purposes of each item and service provided to a Medicare enrollee by a provider, supplier, physician, or other practitioner. In the August 2014 final rule (79 FR 49854), we stated our belief

that release of payment data at the level of the encounter record might reveal proprietary negotiated payment rates between MA plans and providers and, therefore, we restricted the release of payment data by only allowing for its release if aggregated. In the Contract Year 2027 proposed rule, CMS stated it was maintaining the guardrails for payment data (dollar amounts) at the level of the encounter as they were originally finalized in the August 2014 final rule. Per the change to Sec. 422.310(f), CMS may only release aggregated dollar amounts reported for an associated encounter, retaining the regulatory text that currently exists at Sec. 422.310(f)(2)(iv)-risk adjustment data is “subject to the aggregation of dollar amounts reported for the associated encounter to protect commercially sensitive data.” As stated in the Contract Year 2027 proposed rule, this change would not limit CMS disclosure of risk adjustment data as authorized under separate statutory authority.

Currently, Sec. 422.310(f)(3) imposes the restriction that risk adjustment data will not become available for release before reconciliation for the applicable payment year has been completed, unless CMS determines that it is necessary for one of four specific exceptions.\44\ Consistent with our proposed changes to remove the list of permissible uses and conditions for release of risk adjustment data, CMS also proposed to remove the detailed list of exceptions for release of risk adjustment data prior to reconciliation in paragraph (f)(3). The change would continue to allow for the release of risk adjustment data prior to reconciliation for the four previously identified exceptions and provide flexibility when CMS receives novel requests for data that have not been reconciled.

\44\ Sec. 422.310(f)(3)(ii) through (f)(3)(v).

As discussed previously in section IV.C of the proposed rule, because MA plans have a window of time in which they should submit data corrections for a given payment year (typically January 31 of the year following the payment year), risk adjustment data are not considered reconciled for payment purposes before that date has passed. For this reason, there is currently a prohibition against releasing the data prior to the final submission deadline except in specific, limited circumstances. However, over time CMS identified more purposes for which using the data prior to reconciliation may be appropriate and that the original reasons and concerns that led to delaying the release of risk adjustment data in the August 2014 final rule may not always apply or may no longer apply. Some of the purposes identified are reflected in the recent changes to Sec. 422.310(f)(3) where additional exceptions for early release were added, one of which is care coordination, but others may include program integrity initiatives that necessitate timelier data or to support beneficiaries in managing their health by allowing them to access and share their current data. For example, currently, through the CMS Blue Button 2.0 Application Programming Interface (API), an individual may choose to share their own Medicare A, B, and D claims data with Medicare-approved applications or websites that a third party (not Medicare) creates, thereby allowing an individual to use health technology and their own data to improve their health outcomes and decision making. In removing restrictions related to releasing pre-reconciled risk adjustment data, this tool could also be made available to MA enrollees.

While this update allows for release of risk adjustment data prior to reconciliation broadly, CMS understands that it is not always necessary and appropriate for risk adjustment data to be released prior to reconciliation. For example, relying on diagnosis information for research or program operations may not be appropriate before the final risk adjustment data submission deadline since plans have at least 13 months after the end of the service year to submit additional diagnoses for payment. CMS will review requests for the release of risk adjustment data prior to reconciliation to assess whether pre- reconciled data is necessary and appropriate for the requester's purpose. CMS's updates to remove restrictions on the use and release of pre-reconciled risk adjustment data would provide greater flexibility in the release of risk adjustment data, supporting the goals of Executive Order 14243 “Stopping Waste, Fraud, and Abuse by Eliminating Information Silos” (March 20, 2025). Additionally, by no longer restricting release to prescribed purposes, CMS is supporting the goals of Executive Order 14192 “Unleashing Prosperity through Deregulation” (January 31, 2025) by reducing the burden for CMS and external entities associated with the increasingly complex regulation that necessitates rulemaking when an unanticipated use of the data is identified.

CMS sought public comments on all aspects of the proposed revisions to the use and release of risk adjustment data at Sec. 422.310(f) and allowing for greater flexibility in the release of data prior to the final risk adjustment data submission deadline. Summaries of and responses to the public comments on CMS's proposal to revise Sec. 422.310(f) are presented below.

Comment: The majority of commenters supported CMS's proposal to revise 42 CFR 422.310(f) to ease restrictions on the use and release of MA risk adjustment data. These commenters emphasized that increased transparency is necessary given the continued growth of the MA program and that the proposed revisions would better align MA risk adjustment data availability with OM data, noting that current regulations constrained research, oversight, and program evaluation. Commenters asserted that broader access to MA risk adjustment data would result in greater transparency and support improved program integrity, research, innovation, and accountability, including analyses of coding practices, care delivery, and utilization trends.

Response: CMS thanks the commenters for their support.

Comment: Many commenters supported the flexibility provided with the proposed regulatory revision to relax restrictions regarding the timing of release of MA risk adjustment data. Some commenters noted that delays and gaps in MA data have limited timely evaluation of MA program impacts on patient outcomes and costs, and emphasized that, given the growth of MA enrollment, MA data should more closely match OM data in timeliness, completeness, and quality. Several commenters urged CMS to ensure the data released is accurate and complete, requesting that CMS improve the completeness of encounter data to prevent inaccurate or misleading conclusions. A couple of commenters opposed the release of pre-reconciled data or urged CMS to maintain restrictions on pre-reconciled data, warning that incomplete or unvalidated data could be misinterpreted and result in inaccurate analysis.

Response: CMS appreciates the thoughtful comments and acknowledges the concerns raised regarding timeliness and completeness of MA risk adjustment data. While the proposed revision allows for release of MA risk adjustment data prior to reconciliation more broadly, CMS understands that it is not always necessary or appropriate for risk adjustment data to be used or released prior to the final risk adjustment data submission deadline, which is when data are considered reconciled for payment purposes for a given payment year. However, over time and as encounter data has matured, the

original reasons and concerns that led to delaying the release of risk adjustment data in the August 2014 final rule may not always apply or may no longer apply. As reflected in the recent changes to Sec. 422.310(f)(3), CMS has identified purposes for which use of the data prior to reconciliation may be appropriate, such as emergency preparedness and care coordination, and CMS believes other purposes may include those for program integrity, emerging health situations, to support beneficiaries in managing their health by allowing them to access and share their current data, for example, through the CMS Blue Button 2.0 Application Programming Interface (API), or for research initiatives that necessitate timelier data. Having flexibility to release risk adjustment data prior to reconciliation when necessary and appropriate reduces regulatory burden and removes barriers that slow progress and limit opportunities to effectively and efficiently administer, oversee, and improve Federal programs.

CMS will continue to review requests for pre-reconciled MA risk adjustment data to ensure that pre-reconciled data are necessary and appropriate for the requester's purpose. The completeness and validity of the data will be considered during the review process. An example of a necessary and appropriate use of pre-reconciled data would be for the care coordination of beneficiaries participating in State Medicaid programs. However, since plans have at least 13 months after the end of the service year to submit diagnoses for payment, relying on diagnosis information for research or program operations may not always be appropriate before the final risk adjustment data submission deadline.

CMS continues to employ a range of activities aimed at improving the completeness and validity of encounter data including submission outreach, technical assistance, data analysis, and monitoring. These activities continue to improve the completeness and validity of encounter data. CMS continues to see evidence in the data that the efforts by the agency and MA organizations to improve accuracy and completeness of encounter data have been effective. Specifically, CMS's analysis conducted in 2023 found that the utilization data are complete in a similar time frame as OM claims. Further, a recent CMS analysis of encounter data records with 2021 dates of services submitted for payment year 2022 found that 97.7 percent of all encounter data records submitted by the risk adjustment reconciliation deadline (July 31, 2023) had been submitted by August 2022--8 months after the end of the service year.

Comment: Several commenters stressed the importance of maintaining appropriate beneficiary privacy protections and enforcing robust safeguards through data sharing agreements and privacy and security requirements with expanded data sharing to ensure confidentiality and compliance with applicable Federal laws. A couple of commenters called for additional privacy protections, de-identification standards, and controlled-access environments.

Response: As noted in the proposed rule, CMS will maintain existing guardrails that protect beneficiary information in accordance with applicable Federal laws such as the Privacy Act of 1974, section 1106(a) of the Act, and CMS information disclosure regulations at 42 CFR part 401, subpart B. CMS will be able to release an individual's risk adjustment data when authorized by that individual. For other kinds of requests for release of MA risk adjustment data, CMS will release such information in accordance with CMS data sharing procedures that reflect applicable Federal laws and agency privacy and security policies, consistent with current practice. We intend to continue to protect beneficiary data through, for example, encryption, or removal of the confidential fields when risk adjustment data is released. CMS has an established process to evaluate requests for CMS data and enters into data sharing agreements with data requesters for disclosures of MA risk adjustment data to ensure that data requesters agree to comply with CMS privacy and security requirements and data release policies. CMS maintains that this process contains the necessary checks and safeguards to appropriately protect beneficiary identifying information.

Comment: Some commenters requested transparency and clarity on what MA data fields are available for release and when data would be released, including requests for publication of a comprehensive data- element inventory, release cadence, and context notes to avoid misinterpretation or inaccurate analysis given the complexity of MA risk adjustment data. A few commenters requested clarity on which external entities or third parties may receive access to the data, under what terms or agreements and for what purposes. A commenter requested CMS retain explicit regulatory language noting that MA risk adjustment data may be released to States to avoid implying that CMS might bypass longstanding state partnerships as it broadens authority for external releases.

Response: MA risk adjustment data can be requested by external stakeholders, such as an individual, a group, an organization, a State, or Federal Agency, for a variety of purposes including, for example, for program administration and oversight, care coordination, research initiatives, public health preparedness, program integrity, and quality improvement. CMS does not intend to bypass longstanding state partnerships as it broadens authority for external releases.

As discussed in the proposed rule, CMS has long-standing data sharing procedures and pathways for entities to request and obtain approval for access to CMS data, including risk adjustment data. This includes an evaluation by CMS to ensure that data requests comply with applicable Federal laws, regulations, and CMS data sharing policies. As part of the request process, unless the requester is a beneficiary requesting his or her own data, a data sharing agreement is established between CMS and the requesters prior to disclosing the data that documents the terms and conditions under which CMS data may be released and used to ensure that data requesters agree to comply with CMS privacy and security requirements and data release policies, including safeguards to protect beneficiary identifying information and confidentiality. In addition, data sharing agreements provide for potential enforcement mechanisms and penalties. Requesters of CMS data are responsible for abiding by applicable federal and state law, as well as the policies and restrictions of the data sharing agreements.

General information on data products and data files available to external stakeholders can be found at the following link: https://www.cms.gov/data-research/cms-data/learn-more-about-cms-data. Detailed information on research requests, including the Research Data Use Agreement (DUA) and datafiles (including variables) available for request can be found at: https://resdac.org/.

Comment: Several commenters appreciated that CMS maintained the regulatory language restricting the release of plan-submitted dollar amounts, with a few of those commenters stating that this restriction preserves safeguards on commercially sensitive information and minimizes the risk of potentially anticompetitive harm. A few commenters urged CMS to expand transparency by releasing the plan- submitted dollar amounts at the encounter level, arguing that the

continued restriction on dollar amounts limits the ability to evaluate MA spending, provider payment methodologies, and enrollee cost-sharing, and is inconsistent with broader federal price transparency initiatives. These commenters asserted that increased disclosure could improve understanding of MA program performance, value of care, and benefit beneficiaries without causing competitive harm.

Response: CMS thanks commenters for their comments and acknowledges concerns regarding the restriction of plan-submitted payment data. At this time, CMS will maintain the restrictions that currently exist such that we will not release plan-submitted dollar amounts associated with the items or services for which data is submitted to CMS pursuant to Sec. 422.310(b) to characterize the context and purposes of each item and service provided to a Medicare enrollee by a provider, supplier, physician, or other practitioner. In the August 2014 final rule, we stated our belief that release of payment data at the level of the encounter record might reveal proprietary negotiated payment rates between MA plans and providers and, therefore, we restricted the release of payment data at the level of the encounter record without taking steps to protect the information through aggregation. While changes in federal laws and regulations, such as the Transparency in Coverage Final Rule (CMS-9915-F), and Executive Order 14221 “Making America Healthy Again by Empowering Patients With Clear, Accurate, and Actionable Healthcare Pricing Information” (February 25, 2025) are making plan pricing information for specific services more widely available in the group and individual health insurance markets, CMS believes the dollar amounts plans report at the encounter data record level are not ready for release at this time. CMS has not provided extensive guidance for the wide range of payment scenarios that exist in the MA program. As a result, plan practices for reporting service level payment amounts vary widely. CMS's research suggests that the data are a valid representation of MA spending on services in aggregate, but more research and guidance is needed before more detailed data can be made available. Consequently, CMS is maintaining the guardrails for payment data at the level of the encounter as they were originally finalized in the August 2014 final rule, with the inclusion of language to clarify that, as stated previously, these updates do not limit or supersede separate statutory authority that requires CMS disclosure of the data. We look forward to working with stakeholders to continue improving the reliability of plan-submitted payment data and may consider reassessing the restriction on its release in the future.

Comment: A commenter raised concerns about commercial use of MA risk adjustment data, particularly with AI/machine learning companies, and urged CMS to limit or prohibit “profit-driven” reuse of such risk adjustment data.

Response: In the August 2014 final rule CMS stated our intention to have consistent policies for the release of data across the OM (Parts A and B) program, the Part D prescription drug program, and the Part C Medicare Advantage program. We noted that in the event policy regarding the release of Parts A, B, and D data for commercial purposes were to change, we would also revise our Part C risk adjustment data sharing policies to be consistent with that change. Since 2014, CMS has established an innovator research program that allows a researcher associated with a for-profit organization to request data for research, or anyone to conduct research with the intent to create a product or tool to be sold. For example, an innovator could use CMS data to develop care management or predictive modeling tools. There are a number of additional protections in place to access data through the innovator research program. First, innovators provide information on the research that will be conducted. This is reviewed and approved by the CMS Privacy Board.\45\ Second, innovators are required to provide information on the product, tool, or analyses that will be created using the CMS data. This information undergoes an extensive review to ensure that the data is not used to exploit beneficiaries or to create fraud or abuse in the CMS programs. CMS data cannot be used for marketing purposes. Finally, innovators are only permitted to access CMS data that are approved for their research protocol within the CMS Chronic Condition Warehouse Virtual Research Data Center (CCW VRDC). The CCW VRDC is a virtual research environment for securely accessing and analyzing CMS data. All individual-level data are stored in the CCW VRDC and cannot be downloaded. Innovators only have the ability to download aggregated and de-identified reports and results to their own personal workstation. CMS maintains that these protections provide sufficient safeguards on the commercial use of MA risk adjustment data.

\45\ The CMS Privacy Board is an internal CMS panel that reviews research requests for compliance with CMS data policies, but does not act as a HIPAA Privacy Board.

Comment: We received some comments that were out of the scope of this regulation including broader transparency for MA data beyond risk adjustment data such as plan-level metrics, the cost of MA encounter data, more timely reporting requirements, additional reporting requirements, updates to the Part C and Part D risk adjustment models, and improvements to condition specific data. Additionally, some commenters requested CMS ensure plans receive risk adjustment data as early as possible for beneficiaries that move into their plan and others voiced concern regarding plan-initiated medical record requests.

Response: We thank the commenters for their feedback; however, we note that these comments are out of scope for the changes proposed to Sec. 422.310(f). This provision concerns the use and release of the risk adjustment data MA organizations are required to submit to CMS. This provision does not address arrangements between plans and providers, risk adjustment methodology, or plan submission requirements.

After consideration of the public comments we received, we are finalizing the provisions at Sec. 422.310(f) as proposed.