(a) CMS will monitor and assess the performance of qualified entities and their contractors using the following methods:
(1) Audits.
(2) Submission of documentation of data sources and quantities of data upon the request of CMS and/or site visits.
(3) Analysis of specific data reported to CMS by qualified entities through annual reports (as described in paragraph (b) of this section) and reports on inappropriate disclosures or uses of beneficiary identifiable data (as described in paragraph (c) of this section).
(4) Analysis of complaints from beneficiaries and/or providers or suppliers.
(b) A qualified entity must provide annual reports to CMS containing information related to the following:
(1) General program adherence, including the following information:
(i) The number of Medicare and private claims combined.
(ii) The percent of the overall market share the number of claims represent in the qualified entity's geographic area.
(iii) The number of measures calculated.
(iv) The number of providers and suppliers profiled by type of provider and supplier.
(v) A measure of public use of the reports.
(2) The provider and supplier data sharing, error correction, and appeals process, including the following information:
(i) The number of providers and suppliers requesting claims data.
(ii) The number of requests for claims data fulfilled.
(iii) The number of error corrections.
(iv) The type(s) of problem(s) leading to the request for error correction.
(v) The amount of time to acknowledge the request for data or error correction.
(vi) The amount of time to respond to the request for error correction.
(vii) The number of requests for error correction resolved.
(c) A qualified entity must inform CMS of inappropriate disclosures or uses of beneficiary identifiable data under the DUA.
(d) CMS may take the following actions against a qualified entity if CMS determines that the qualified entity violated any of the requirements of this subpart, regardless of how CMS learns of a violation:
(1) Provide a warning notice to the qualified entity of the specific concern, which indicates that future deficiencies could lead to termination.
(2) Request a corrective action plan (CAP) from the qualified entity.
(3) Place the qualified entity on a special monitoring plan.
(4) Terminate the qualified entity.