CMS Requests Public Comments on the Potential Release of Medicare Physician Data

Back in late June ProPublica published the Medicare Part D data as part of a public request for information, under the Freedom of Information Act (FOIA). Now CMS is seeking comment, if in fact a release of physician level Medicare claims data is a good idea or not. Does the release of this data potentially violate a physician’s right to privacy?

In late May of this year, we reported that a federal district court in Florida had vacated an injunction issued in 1979 that barred the Department of Health and Human Services (HHS) from disclosing certain Medicare payment claims data for physicians.

In 1978, the Department of Health, Education, and Welfare (now HHS), planned to release a list of all physicians and providers who received $100,000 or more in Medicare reimbursements in 1977, including physician names and net total amounts of Medicare reimbursements paid directly to each physician, as HEW had similarly done the year before. Prior to the release of this second list, the Florida Medical Association (FMA) and six individual physicians, joined by the American Medical Association (AMA), representing their physician members who provide Medicare services, filed suit to enjoin HEW from releasing this list and any similar lists in the future.

In 1979, a Florida federal court granted an injunction in favor of the physicians and other plaintiffs after finding that the disclosure was covered by Freedom of Information Act (FOIA) Exemption 6, which provides that FOIA “does not apply to matters that are . . . personnel and medical files and similar files the disclosure of which would constitute a clearly unwarranted invasion of personal privacy,” and therefore violated the Privacy Act. The injunction permanently enjoined HHS from disclosing any lists of annual Medicare reimbursement amounts for any years that would individually identify a recertified class of physicians. Florida Med. Ass’n v. Department of Health Educ. & Welfare, 479 F. Supp. 1291 (M.D. Fla. 1979).

Subsequently, in 2011, Dow Jones & Company (parent company of The Wall Street Journal) and Real Time Medical Data (RTMD), a consulting firm, sought access to physician-level Medicare payment data in 2011. They formally intervened in the 1979 injunction case and petitioned the court to overturn the injunction.

HHS joined Dow Jones and RTMD in the case on the grounds that the 1979 injunction was no longer equitable because it was a type of broad, prospective injunctive relief that was no longer authorized under the Privacy Act after the Eleventh Circuit’s decision in Edison v. Department of the Army. The new case is Florida Med. Ass’n v. Department of Health, Educ. & Welfare, No. 3:78-CV-178-34-MCR (M.D. Fla. May 31, 2013) (below is a more detailed summary).

On May 31st, 2013, the U.S. District Court for the Middle District of Florida vacated the injunction (see below for further details). The Court reasoned that the “broad, forward reaching” 1979 injunction, “which bars HHS from ever ‘disclosing any list of annual Medicare reimbursement amounts, for any years,’ goes far beyond the relief available under the APA.”  “Such far reaching relief was not authorized under the APA” in 1979, the court held, “nor is it appropriate now.”

The parties each had until July 30, 2013 to appeal the court’s decision, and no appeal was filed.

In response to this court opinion, the Centers for Medicare & Medicaid Services (CMS) issued a notice for public comments regarding certain physician and patient privacy issues that may be implicated by the vacated injunction and any future publication of Medicare payment data. CMS also posted this announcement on the agency’s blog.

CMS explained that while the court has vacated the injunction, HHS’s policy regarding release of individual physician data, adopted in 1980, states “that the public interest in the individually identified payment amounts is not sufficient to compel disclosure in view of the privacy interests of the physicians.” HHS created this policy in response to the 1979 injunction.

As a result, with the recent decision to vacate the injunction, and in light of the Agency’s demonstrated commitment to transparency, CMS seeks public input as the Agency considers what would be the most appropriate policy regarding release of physician payment data. Specifically, CMS seeks comments and input with regard to:

1. Whether physicians have a privacy interest in information concerning payments they receive from Medicare and, if so, how to properly weigh the balance between that privacy interest and the public interest in disclosure of Medicare payment information, including physician-identifiable reimbursement data;
   
2. What specific policies CMS should consider with respect to disclosure of individual physician payment data that will further the goals of improving the quality and value of care, enhancing access and availability of CMS data, increasing transparency in government, and reducing fraud, waste, and abuse within CMS programs, while also preventing the release of any health information on any Medicare beneficiary; and
   

1. The form in which CMS should release information about individual physician payment, should CMS choose to release it (e.g., line item claim details, aggregated data at the individual physician level).
   

Comments are due 30 days from the date of this request, which was published August 6th, 2013, by 5:00p.m.
Comments can be submitted by email to Physician_Data_Comments@cms.hhs.gov.

While CMS has issued a “notice for comment,” the agency’s blog post emphasizes that CMS is “working to usher in a new era of transparency and is very pleased to announce its next steps to create a more transparent health care system.” Such language suggests that the publication of physician Medicare payment data is highly likely in the future.

Lifting the 1979 injunction does not mean, however, that HHS and CMS will or must release immediately any physician-identifying Medicare reimbursement records.  Rather, the court held, vacatur simply leaves HHS free to determine whether factual circumstances and/or FOIA law or other legal standards and precedents have changed sufficiently since 1979 as to require releases of physician-identifying Medicare data.  The court instructed that Dow Jones, Real Time Medical, and/or others interested in the data “will have to submit a FOIA request for specified information.”

Background of CMS’ Notice

Since 2010, when CMS launched its “Health Data Initiative,” the agency “has released an unprecedented amount of aggregated data in machine-readable form. These data range from previously unpublished statistics on Medicare spending, utilization, and quality at the state, hospital referral region, and county level, to detailed information on the quality performance of hospitals, nursing homes, and other providers.”

CMS is also engaged with a wide range of public, non-profit, and private sector stakeholders to foster the availability and use of health care data to drive innovations that improve health and health care—such as ProPublica, which obtained certain Medicare reimbursement data regarding Medicare Part D (drugs) through a FOIA request and made such data publicly available through its “Prescriber Checkup” program.

Additionally, in May of this year, CMS released information on the average charges for the 100 most common inpatient services at more than 3,000 hospitals nationwide, followed in June with the release of average charges for 30 selected outpatient procedures. CMS and HHS have made such disclosures in the interest of the Obama administration’s “strong commitment to greater data transparency” and have prioritized the provision of Medicare data to Accountable Care Organizations (ACO) partnering with Medicare to improve care.

When a third party (such as a member of the news media) makes a request for information for individually identifiable physician information, such as the amount of annual Medicare payments a physician received, CMS must disclose the information under the FOIA unless an exemption applies. In this case, since physician information is covered by the Privacy Act, CMS looks at whether such disclosure may constitute a clearly unwarranted invasion of personal privacy by weighing whether the public interest in disclosure outweighs the physician’s privacy interest in the information.

Since the 1979 injunction, CMS explained that “a number of changes have occurred related to physicians’ privacy interests in maintaining the confidentiality of their Medicare payments and the public interest in disclosure of such amounts.” For example, CMS cited:

• Public interest in the information has increased given the substantial growth in size of Medicare since 1979, both in terms of total cost per year and as a portion of the federal budget;
  
• Changes in the Medicare reimbursement system that have resulted in greater standardization of payment amounts for physician services;
  
• The creation of the Qualified Entity program (known as Medicare data sharing for performance reporting), authorized by Section 10332 of the Affordable Care Act, which allows CMS to disclose Medicare claims data to qualified entities for the production of public performance reports; and
  
• The greater consequences of Medicare fraud, waste, and abuse, which disclosure of payment information could help expose.
  

Dow Jones and RTMD similarly cited these changes in their motions to vacate the 1979 injunction.

In addition, during the past several years, CMS’ management role as a processor of Medicare claims for services has evolved toward becoming a more effective steward and partner of transformation in the health care system with the goal of incentivizing high quality care and better health at lower costs. Accordingly, CMS noted that it now “receives multiple requests from various stakeholders for physician payment and reimbursement data. These requestors argue that this data is an important part of the ongoing research, assessment, and evaluation of programs and services necessary to make improvements in the delivery, quality, and cost of care.”

CMS said it “recognizes the role data can play in achieving the common goal of better quality health care at lower costs,” which is why the agency is asking for public comments to consider amending its policy and disclosing this payment information. CMS emphasized that it is “not considering public disclosure of any information that could directly or indirectly reveal patient-identifiable information” and “is committed to protecting the privacy of Medicare beneficiaries.”

2013 FMA Case

The 1979 injunction remained undisturbed until 2003, when Jennifer Alley, owner of RTMD, which uses Medicare claims data to assist hospitals and other clients with marketing and strategic planning efforts, filed a FOIA request in 2003 with HHS, as reported by the American Health Lawyers Association (AHLA). The request sought data on all Medicare claims paid in 2002 for procedures performed in several states.

HHS provided Alley with some of the information she requested, but refused to release any Medicare Part B outpatient claims data to avoid a “clearly unwarranted invasion of personal privacy” under FOIA Exemption 6, and to avoid running afoul of the 1979 injunction, AHLA writes. The district court ordered disclosure of the requested claims data, finding the injunction should be narrowly construed.

Alley appealed this decision to the U.S. Eleventh Circuit Court of Appeals, which reversed the district court, finding the claims data at issue were covered by the 1979 injunction. The appeals court, however, suggested those attempting to obtain the data could seek modification of the injunction from the issuing court—the U.S. Middle District of Florida. Alley v. Department of Health and Human Servs., No. 08-16914 (11th Cir. Dec. 18, 2009).

Around the same time, another case suggested that upon a sufficient showing of how, e.g., physician-identifying CMS data would serve the public interest in targeting Medicare fraud and waste, a release of Medicare payment records might be possible, according to a client alert from the law firm Davis Wright Tremaine LLP citing Consumers’ Checkbook Center for the Study of Services v. HHS, 554 F.3d 1046 (D.C. Cir. 2009).

In challenging the injunction, RTMD asserted that the 1979 injunction should be vacated because the “balance between the physicians’ privacy interests in maintaining Medicare reimbursements confidential and the public interest in disclosure of such information has changed greatly since 1979, making continued enforcement of the 1979 FMA Injunction a “manifest injustice,” as summarized by an article from InsideCounsel.

Additionally, RTMD contended that the physicians’ privacy interest in reimbursement amounts has been further reduced by the “Qualified Entity Program”— created by the Patient Protection and Affordable Care Act of 2009, as amended by the Health Care and Education Reconciliation Act of 2010—because CMS will disclose identifying Medicare Part B data to qualified entities to create provider performance reports and will publish those reports even if the providers suggest that the Medicare data is erroneous.

Dow Jones argued that the Court should vacate the injunction, pursuant to Rule 60, because “the factual and legal landscape” has changed dramatically since 1979: providers no longer set their own “reasonable fees,” the public interest in disclosure of the Medicare data, noting that since 1979, Medicare “has grown twenty-fold in nominal dollars, and nearly three-fold as a percentage of the total federal budget,” and the prevalence of Medicare fraud, InsideCounsel explained.

Dow Jones also offered the Declaration of Malcolm Sparrow, Professor of the Practice of Public Management at Harvard University’s John F. Kennedy School of Government.  Based on over a decade-and-a-half Medicare fraud study, Dr. Sparrow explained the value that the data in CMS’s files offered for providing a window into the efficacy of the Medicare program.

HHS argued that prospective enforcement of the 1979 injunction was no longer equitable because of a change in the law since the injunction was issued, citing the Eleventh Circuit’s decision in Edison v.
Department of Army, 672 F.2d 840 (11th Cir. 1982), which held “the Privacy Act does not authorize injunctive relief against a government agency to prevent it from disclosing information,” reported AHLA.

The Court held that vacatur was required because “it is beyond dispute” that, as precedent clarified after its issuance, the 1979 injunction provided relief not authorized by the Privacy Act, upon which Judge Scott relied, explained the client alert from Davis Wright Tremaine.  “Specifically, several years after the injunction issued, courts clarified that the Privacy Act allows injunctive relief in only two contexts, i.e., wrongful withholding of documents from a person to whom they pertain, and wrongful refusal to amend an individual’s record upon his/her request.  Id. at *19 (discussing Clarkson v. IRS, 678 F.2d 1368 (11th Cir. 1982), and Edison v. Dep’t of the Army, 672 F.2d 840 (11th Cir. 1982)).”

The Court further opined that “‘reverse FOIA jurisprudence[] counsels that long-term broad prospective injunctive relief enjoining an agency from releasing a generalized category of information is detrimental to the public interest, and for this reason, also no longer equitable.”  The court explained that “[t]he premise of a reverse FOIA claim is founded upon judicial review of an agency’s decision to release particular information under FOIA, and a determination of whether, under the APA the agency’s decision was arbitrary, capricious, or contrary to law.  That review applies to particular actions and does not encompass future agency conduct which may or may not occur.”