This message is a reminder that Qualified Clinical Data Registries (QCDRs) and Qualified Registries must enter into and maintain with its participating Merit-based Incentive Payment System (MIPS) clinicians, groups, and virtual groups, an appropriate Business Associate Agreement (BAA) that complies with the Health Insurance Portability and Accountability Act (HIPAA) Privacy and Security Rules (as specified in 81 FR 77367 through 77369, 81 FR 77384 through 77385).
QCDRs and Qualified Registries must ensure that the BAA:
- Provides for the receipt of patient-specific data from individual clinicians, groups, and virtual groups.
- Provides for the disclosure of quality measure results and numerator and denominator data or patient specific data on Medicare and non-Medicare beneficiaries on behalf of individual clinicians, groups, and virtual groups.
QCDRs and Qualified Registries must obtain and keep on file signed documentation that each National Provider Identifier (NPI) holder whose data are submitted to the QCDR or Qualified Registry has authorized the QCDR or Qualified Registry to submit:
- Quality measure results.
- Improvement Activities activity results.
- Promoting Interoperability measure and objective results.
- Numerator and denominator data or patient-specific data on Medicare and non-Medicare beneficiaries to the Centers for Medicare & Medicaid Services (CMS) for the purpose of MIPS participation.
This documentation should be obtained at the time the individual clinician, group, and virtual group sign up with the QCDR or Qualified Registry to submit MIPS data to the QCDR or Qualified Registry and must meet the requirements of any applicable laws, regulations, and contractual BAAs.
A practice administrator may give consent on behalf of a group or virtual group reporting as a group, but not for an individual clinician reporting as an individual. This process needs to comply with the requirements of the BAA to ensure that it provides for your receipt of patient-specific data from individual clinicians, groups, and virtual groups, as well as the QCDR’s or Qualified Registry’s disclosure of quality measure results and numerator and denominator data and/or patient-specific data on Medicare and non-Medicare beneficiaries on behalf of MIPS clinicians, groups, and virtual groups.
CMS requires signed and dated electronic or written BAA and clinician consent provided that electronic signatures or authorization are legal in your jurisdiction. QCDRs and Qualified Registries must keep their BAA and clinician consent records as proof of consent in the event CMS requests that vendors substantiate that they have obtained necessary contracts and consents.
Contact the Quality Payment Program at 1-866-288-8292 or by email at: QPP@cms.hhs.gov, Monday-Friday 8 a.m.- 8 p.m. Eastern Time (ET). To receive assistance more quickly, please consider calling during non-peak hours—before 10 a.m. and after 2 p.m. ET.
Customers who are hearing impaired can dial 711 to be connected to a TRS Communications Assistant.