(a) General. CMS shares certain beneficiary-identifiable data as described in paragraphs (b), (c), and (e) of this section and certain regional aggregate data as described in paragraph (d) of this section with TEAM participants regarding TEAM beneficiaries and performance under the model.

(b) Beneficiary-identifiable claims data. CMS shares beneficiary-identifiable claims data with TEAM participants as follows:

(1) CMS makes available certain beneficiary-identifiable claims data described in paragraph (b)(5) of this section for TEAM participants to request for purposes of conducting health care operations work that falls within the first or second paragraph of the definition of health care operations at 45 CFR 164.501 regarding their TEAM beneficiaries.

(2) A TEAM participant that wishes to receive beneficiary-identifiable claims data for its TEAM beneficiaries must do all of the following:

(i) Submit a formal request for the data on at least an annual basis in a manner and form and by a date specified by CMS, indicating their selection of summary beneficiary-identifiable data, raw beneficiary-identifiable data, or both, and attest that—

(A) The TEAM participant is requesting claims data of TEAM beneficiaries who would be in an episode during the baseline period or performance year, as a HIPAA covered entity.

(B) The TEAM participant's request reflects the minimum data necessary, as set forth in paragraph (c) of this section, for the TEAM participant to conduct health care operations work that falls within the first or second paragraph of the definition of health care operations at 45 CFR 164.501.

(C) The TEAM participant's use of claims data is limited to developing processes and engaging in appropriate activities related to coordinating care, improving the quality and efficiency of care, and conducting population-based activities relating to improving health or reducing health care costs that are applied uniformly to all TEAM beneficiaries, in an episode during the baseline period or performance year, and that these data are not to be used to reduce, limit or restrict care for specific Medicare beneficiaries.

(ii) Sign and submit a TEAM data sharing agreement, as defined in § 512.505, with CMS as set forth in paragraph (e) of this section.

(3) CMS shares this beneficiary-identifiable claims data with a TEAM participant in accordance with applicable privacy and security laws and established privacy and security protections.

(4) CMS omits from the beneficiary-identifiable claims data any information that is subject to the regulations in 42 CFR part 2 governing the confidentiality of substance use disorder patient records.

(5) The beneficiary-identifiable claims data includes, when available, the following:

(i) Unrefined (raw) Medicare Parts A and B beneficiary-identifiable claims data for TEAM beneficiaries in an episode during the 3-year baseline period and performance year.

(ii) Summarized (summary) Medicare Parts A and B beneficiary-identifiable claims data for TEAM beneficiaries in an episode during the 3-year baseline period and performance year.

(6) CMS makes available the beneficiary-identifiable claims data for retrieval by TEAM participants at the following frequency:

(i) Annually, at least 1 month prior to every performance year for baseline period data, based on the baseline periods described in § 512.540(b)(2).

(ii) Monthly during the performance year and for up to 6 months after the performance year for performance year data.

(c) Minimum necessary data. The TEAM participant must limit its request for beneficiary-identifiable data under paragraph (b) of this section to the minimum necessary Parts A and B data elements which may include, but are not limited to the following:

(1) Medicare beneficiary identifier (ID).

(2) Procedure code.

(3) Gender.

(4) Diagnosis code.

(5) Claim ID.

(6) The from and through dates of service.

(7) The provider or supplier ID.

(8) The claim payment type.

(9) Date of birth and death, if applicable.

(10) Tax identification number.

(11) National provider identifier.

(d) Regional aggregate data. (1) CMS shares regional aggregate data for the 3-year baseline period and performance years with TEAM participants as follows:

(i) Shares 3-year baseline period regional aggregate data annually at least 1 month before the performance year, based on the baseline periods described in § 512.540(b)(2).

(ii) Shares performance year regional aggregate data on a monthly basis during the performance year and for up to 6 months after the performance year.

(2) Regional aggregate data—

(i) Is aggregated based on all Parts A and B claims associated with episodes in TEAM for the U.S. Census Division in which the TEAM participant is located;

(ii) Summarizes average episode spending for episodes in TEAM in the U.S. Census Division in which the TEAM participant is located; and

(iii) Is de-identified in accordance with 45 CFR 164.514(b).

(e) TEAM data sharing agreement. (1) A TEAM participant who wishes to retrieve the beneficiary-identifiable data specified in paragraph (b) of this section, must complete and submit, on at least an annual basis, a signed TEAM data sharing agreement, as defined in § 512.505, to be provided in a form and manner and by a date specified by CMS, under which the TEAM participant agrees:

(i) To comply with the requirements for use and disclosure of this beneficiary-identifiable data that are imposed on covered entities by the HIPAA regulations and the requirements of the TEAM set forth in this part.

(ii) To comply with additional privacy, security, breach notification, and data retention requirements specified by CMS.

(iii) To contractually bind each downstream recipient of the beneficiary-identifiable data that is a business associate of the TEAM participant to the same terms and conditions to which the TEAM participant is itself bound in its TEAM data sharing agreement with CMS as a condition of the business associate's receipt of the beneficiary-identifiable data retrieved by the TEAM participant under TEAM.

(iv) That if the TEAM participant misuses or discloses the beneficiary-identifiable data in a manner that violates any applicable statutory or regulatory requirements or that is otherwise non-compliant with the provisions of the TEAM data sharing agreement, CMS may deem the TEAM participant ineligible to retrieve beneficiary-identifiable data under paragraph (b) of this section for any amount of time, and the TEAM participant may be subject to additional sanctions and penalties available under the law.

(2) A TEAM participant must comply with all applicable laws and the terms of the TEAM data sharing agreement in order to retrieve the beneficiary-identifiable data.