A. The Virginia All-Payer Claims Database is hereby created to facilitate data-driven, evidence-based improvements in access, quality, and cost of health care and to promote and improve the public health through the understanding of health care expenditure patterns and operation and performance of the health care system.

B. The Commissioner shall ensure that the Department meets the requirements to be a health oversight agency as defined in 45 C.F.R. § 164.501.

C. The Commissioner, in cooperation with the Bureau of Insurance, shall collect paid claims data for covered benefits from data suppliers, which shall include:

1. Issuers of individual or group accident and sickness insurance policies providing hospital, medical and surgical, or major medical coverage on an expense-incurred basis; corporations providing individual or group accident and sickness subscription contracts; and health maintenance organizations providing a health care plan for health care services, for at least 1,000 covered lives in the most recent calendar year;

2. Third-party administrators and any other entities that receive or collect charges, contributions, or premiums for, or adjust or settle health care claims for, at least 1,000 Virginia covered lives on behalf of group health plans other than ERISA plans;

3. Third-party administrators, and any other entities, that receive or collect charges, contributions, or premiums for, or adjust or settle health care claims for, an employer that maintains an ERISA plan that has opted-in to data submission to the All-Payer Claims Database pursuant to subsection P;

4. The Department of Medical Assistance Services with respect to services provided under programs administered pursuant to Titles XIX and XXI of the Social Security Act;

5. State government health insurance plans;

6. Local government health insurance plans, subject to their ability to provide such data and to the extent permitted by state and federal law; and

7. Federal health insurance plans, to the extent permitted by federal law, including Medicare, TRICARE, and the Federal Employees Health Benefits Plan.

Such collection of paid claims data for covered benefits shall not include data related to Medigap, disability income, workers’ compensation claims, standard benefits provided by long-term care insurance, disease specific health insurance, dental or vision claims, or other supplemental health insurance products;

D. The Commissioner shall ensure that the nonprofit organization executes a standard data submission and use agreement with each entity listed in subsection B that submits paid claims data to the All-Payer Claims Database and each entity that subscribes to data products and reports. Such agreements shall include procedures for submission, collection, aggregation, and distribution of specified data. Additionally, the Commissioner shall ensure that the nonprofit organization:

1. Protects patient privacy and data security pursuant to provisions of this chapter and state and federal privacy laws, including the federal Health Insurance Portability and Accountability Act (42 U.S.C. § 1320d et seq., as amended); Titles XIX and XXI of the Social Security Act; § 32.1-127.1:03; Chapter 6 of Title 38.2; and the Health Information Technology for Economic and Clinical Health (HITECH) Act, as included in the American Recovery and Reinvestment Act (P.L. 111-5, 123 Stat. 115) as if the nonprofit organization were covered by such laws;

2. Identifies the type of paid claims to be collected by the All-Payer Claims Database and the entities that are subject to the submission of such claims as well as identification of specific data elements from existing claims systems to be submitted and collected, including but not limited to patient demographics, diagnosis and procedure codes, provider information, plan payments, member payment responsibility, and service dates;

3. Administers the All-Payer Claims Database in a manner to allow for geographic, demographic, economic, and peer group comparisons;

4. Develops public analyses identifying and comparing health plans by public and private health care purchasers, providers, employers, consumers, health plans, health insurers, and data analysts, health insurers, and providers with regard to their provision of safe, cost-effective, and high-quality health care services;

5. Uses common data layout or other national data collection standards and methods that utilize a standard set of core data elements for data submissions, as adopted or endorsed by the APCD Council, to establish and maintain the database in a cost-effective manner and to facilitate uniformity among various all-payer claims databases of other states and specification of data fields to be included in the submitted claims, consistent with such national standards, allowing for exemptions when submitting entities do not collect the specified data or pay on a per-claim basis, such exemption process to be managed by the advisory committee created pursuant to subsection E;

6. Does not disclose or report provider-specific, facility-specific, or carrier-specific reimbursement information, or information capable of being reverse-engineered, combined, or otherwise used to calculate or derive such reimbursement information, from the All-Payer Claims Database;

7. Promotes the responsible use of claims data to improve health care value and preserve the integrity and utility of the All-Payer Claims Database; and

8. Requires that all public reports and analyses comparing providers or health plans using data from the All-Payer Claims Database use national standards or, when such national standards are unavailable, provide full transparency to providers or health plans of the alternative methodology used.

E. The Commissioner shall establish an advisory committee to assist in the formation and operation of the All-Payer Claims Database. Such committee shall consist of (i) a representative from each of the following: a statewide hospital association, a statewide association of health plans, a professional organization representing physicians, a professional organization representing pharmacists, an organization that processes insurance claims or certain aspects of employee benefits plans for a separate entity, a community mental health center who has experience in behavioral health data collection, a nursing home health care provider who has experience with medical claims data, a nonprofit health insurer, and a for-profit health insurer; (ii) up to two representatives with a demonstrated record of advocating health care issues on behalf of consumers; (iii) two representatives of hospitals or health systems; (iv) an individual with academic experience in health care data and cost-efficiency research; (v) a representative who is not a supplier or broker of health insurance from small employers that purchase group health insurance for employees; (vi) a representative who is not a supplier or broker of health insurance from large employers that purchase health insurance for employees, and (vii) a representative who is not a supplier or broker of health insurance from self-insured employers, all of whom shall be appointed by the Commissioner. The Commissioner, the chairman of the board of directors of the nonprofit organization, the Commissioner of Insurance, the Director of the Department of Medical Assistance Services, the Director of the Department of Human Resource Management, or their designees, shall serve ex officio.

In appointing members to the advisory committee, the Commissioner shall adopt reasonable measures to select representatives in a manner that provides balanced representation within and among the appointments and that any representative appointed is without any actual or apparent conflict of interest, including conflicts of interest created by virtue of the individual’s employer’s corporate affiliations or ownership interests.

The nonprofit organization shall provide the advisory committee with details at least annually on the use and disclosure of All-Payer Claims Database data, including reports developed by the nonprofit organization; details on methods used to extract, transform, and load data; and efforts to protect patient privacy and data security.

The meetings of the advisory committee shall be open to the public.

F. The Commissioner shall establish a data release committee to review and approve requests for access to data. The data release committee shall consist of the Commissioner or his designee, and upon recommendation of the advisory committee, the Commissioner shall appoint an individual with academic experience in health care data and cost-efficiency research; a representative of a health insurer; a health care practitioner; a representative from a hospital with a background in administration, analytics, or research; and a representative with a demonstrated record of advocating health care issues on behalf of consumers. In making its recommendations, the advisory committee shall adopt reasonable measures to select representatives in a manner that provides balanced representation within and among the appointments and that any representative appointed is without any actual or apparent conflict of interest, including conflicts of interest created by virtue of the individual’s employer’s corporate affiliations or ownership interests. The data release committee shall ensure that (i) all data approvals are consistent with the purposes of the All-Payer Claims Database as provided in subsection A; (ii) all data approvals comply with applicable state and federal privacy laws and state and federal laws regarding the exchange of price and cost information to protect the confidentiality of the data and encourage a competitive marketplace for health care services; and (iii) the level of detail, as provided in subsection H, is appropriate for each request and is accompanied by a standardized data use agreement.

G. The nonprofit organization shall implement the All-Payer Claims Database, consistent with the provisions of this chapter, to include:

1. The reporting of data that can be used to improve public health surveillance and population health, including reports on (i) injuries; (ii) chronic diseases, including but not limited to asthma, diabetes, cardiovascular disease, hypertension, arthritis, and cancer; (iii) health conditions of pregnant women, infants, and children; and (iv) geographic and demographic information for use in community health assessment, prevention education, and public health improvement. This data shall be developed in a format that allows comparison of information in the All-Payer Claims Database with other nationwide data programs and that allows employers to compare their employee health plans statewide and between and among regions of the Commonwealth and nationally.

2. The reporting of data that payers, providers, and health care purchasers, including employers and consumers, may use to compare quality and efficiency of health care, including development of information on utilization patterns and information that permits comparison of health plans and providers statewide between and among regions of the Commonwealth. The advisory committee created pursuant to subsection E shall make recommendations to the nonprofit organization on the appropriate level of specificity of reported data in order to protect patient privacy and to accurately attribute services and resource utilization rates to providers.

3. The reporting of data that permits design and evaluation of alternative delivery and payment models.

4. The reporting and release of data consistent with the purposes of the All-Payer Claims Database as set forth in subsection A as determined to be appropriate by the data release committee created pursuant to subsection F.

H. Except as provided in subsection O, the nonprofit organization shall not provide data or access to data without the approval of the data release committee. Upon approval, the nonprofit organization may provide data or access to data at levels of detail that may include (i) aggregate reports, which are defined as data releases with all observation counts greater than 10; (ii) de-identified data sets that meet the standard set forth in 45 C.F.R. § 164.514(a); and (iii) limited data sets that comply with the National Institutes of Health guidelines for release of personal health information.

I. Reporting of data shall not commence until such data has been processed and verified at levels of accuracy consistent with existing nonprofit organization data standards. Prior to public release of any report specifically naming any provider or payer, or public reports in which an individual provider or payers represents 60 percent or more of the data, the nonprofit organization shall provide affected entities with notice of the pending report and allow for a 30-day period of review to ensure accuracy. During this period, affected entities may seek explanations of results and correction of data that they prove to be inaccurate. The nonprofit organization shall make these corrections prior to any public release of the report. At the end of the review period, upon completion of all necessary corrections, the report may be released. For the purposes of this subsection, “public release” means the release of any report to the general public and does not include the preparation of reports for, or use of the All-Payer Claims Database by, organizations that have been approved for access by the data release committee and have entered into written agreements with the nonprofit organization.

J. The Commissioner and the nonprofit organization shall consider and recommend, as appropriate, integration of new data sources into the All-Payer Claims Database, based on the findings and recommendations of the advisory committee.

K. Information acquired pursuant to this section shall be confidential and shall be exempt from disclosure by the Virginia Freedom of Information Act (§ 2.2-3700 et seq.). The reporting and release of data pursuant to this section shall comply with all state and federal privacy laws and state and federal laws regarding the exchange of price and cost information to protect the confidentiality of the data and encourage a competitive marketplace for health care services.

L. No person shall assess costs or charge a fee to any health care practitioner related to formation or operation of the All-Payer Claims Database. However, a reasonable fee may be charged to health care practitioners who voluntarily access the All-Payer Claims Database for purposes other than data verification.

M. As used in this section, “provider” means a hospital or physician as defined in this chapter or any other health care practitioner licensed, certified, or authorized under state law to provide covered services represented in claims reported pursuant to this section.

N. The Commissioner, in consultation with the board of directors of the nonprofit organization, shall develop short-term and long-term funding strategies for the operation of the All-Payer Claims Database to provide necessary funding in excess of any budget appropriation by the Commonwealth.

O. The nonprofit organization, the Department of Health, the Department of Medical Assistance Services, and the Bureau of Insurance shall have access to data reported by the All-Payer Claims Database pursuant to this section at no cost for the purposes of public health improvement research and activities.

P. Each employer that maintains an ERISA plan may opt-in to allow a third-party administer or other entity to submit data to the All-Payer Claims Database. For any such employer that opts-in, the third-party administrator or other entity shall (i) submit data for the next reporting period after the opt-in and all future reporting periods until the employer opts-out and (ii) include data from any such employer as part of its data submission, if any, otherwise required by this section. Such an employer may opt-out at any time but shall provide written notice to the third-party administrator or other entity of its decision at least 30 days prior to the start of the next reporting period. No employer that maintains an ERISA plan shall be required to opt-in to data submission to the All-Payer Claims Database, and no third-party administrator or other entity shall be required to submit claims processed before it was contracted to provide services. Each third-party administrator or other entity providing claim administration services for an employer shall submit annually to the nonprofit organization by January 31 of each year a list of the ERISA plans whose employer has opted-in to data submission to the All-Payer Claims Database and a list identifying all employers that maintain an ERISA plan with Virginia employees for which it provides claim administration services. Such information submitted shall be considered proprietary and shall be exempt from disclosure by the Virginia Freedom of Information Act (§ 2.2-3700 et seq.).

Q. Any data release shall make use of a masked proxy reimbursement amount, for which the methodology is publicly available and approved by the data release committee except that the Department may request that the nonprofit organization generate the following reports based on actual reimbursement amounts: (i) the total cost burden of a disease, chronic disease, injury, or health condition across the state, health planning region, health planning district, county, or city, provided that the total cost shall be an aggregate amount encompassing costs attributable to all data suppliers and not identifying or attributable to any individual provider, and (ii) any analyses to determine the average reimbursement that is paid for health care services that may include inpatient and outpatient diagnostic services, surgical services or the treatment of certain conditions or diseases. Any additional report of analysis based on actual reimbursement amounts shall require the approval of the data release committee.

R. The nonprofit organization shall ensure the timely reporting of information by private data suppliers to meet the requirements of this section. The nonprofit organization shall notify private data suppliers of any applicable reporting deadlines. The nonprofit shall notify, in writing, a private data supplier of a failure to meet a reporting deadline, and that failure to respond within two weeks following receipt of the written notice may result in a penalty. The Board may assess a civil penalty of up to $1,000 per week per violation, not to exceed a total of $50,000 per violation, against a private data supplier that fails, within its determination, to make a good faith effort to provide the requested information within two weeks following receipt of the written notice required by this subsection. Civil penalties assessed under this subsection shall be maintained by the Department and used for the ongoing improvement of the All-Payer Claims Database.

2012, cc. 693, 709; 2019, cc. 672, 673.