[Federal Register Volume 64, Number 117 (Friday, June 18, 1999)] [Notices] [Pages 32984-32991] From the Federal Register Online via the Government Publishing Office [www.gpo.gov] [FR Doc No: 99-15529] [[Page 32983]] _______________________________________________________________________ Part VI Department of Health and Human Services _______________________________________________________________________ Health Care Financing Administration _______________________________________________________________________ Medicare and Medicaid Programs; Mandatory Use, Collection, Encoding, and Transmission of Outcome and Assessment Set (OASIS) for Home Health Agencies and Privacy Act of 1974; Report of New System; Notices Federal Register / Vol. 64, No. 117 / Friday, June 18, 1999 / Notices [[Page 32984]] DEPARTMENT OF HEALTH AND HUMAN SERVICES Health Care Financing Administration [HCFA-3020-N] RIN 0938-AJ54 Medicare and Medicaid Programs; Mandatory Use, Collection, Encoding, and Transmission of Outcome and Assessment Information Set (OASIS) for Home Health Agencies AGENCY: Health Care Financing Administration (HCFA), HHS. ACTION: Notice. ----------------------------------------------------------------------- SUMMARY: This notice announces to home health agencies (HHAs), State survey agencies, Medicare and Medicaid beneficiaries, software vendors, and the general public changes to and effective dates for OASIS implementation. This notice announces the effective dates for the mandatory use, collection, encoding, and transmission of OASIS data for all Medicare/Medicaid patients receiving skilled services. For non- Medicare/non-Medicaid patients receiving skilled services, there will be no encoding and transmission until further notice, but HHAs must conduct comprehensive assessments and updates at the required time points. For patients receiving personal care only services, regardless of payor source, we are delaying the requirements regarding OASIS use, collection, encoding, and transmission until further notice. We expect to begin implementation of OASIS for non-Medicare/non-Medicaid patients receiving skilled care and for patients receiving personal care only services in the Spring of 2000. A separate Federal Register notice will be published with instructions at that time. In addition, software changes described at the end of this notice are of interest to software vendors and HHAs. Also, a companion notice concerning the OASIS System of Records (SOR) is published elsewhere in this Federal Register and is available via the HCFA Internet site (http://www.hcfa.gov). EFFECTIVE DATES: This notice is effective on July 19, 1999. FOR FURTHER INFORMATION CONTACT: Tracey Mummert, (410) 786-3398, Mary Weakland, (410) 786-6835. SUPPLEMENTARY INFORMATION: I. Background On January 25, we published a final regulation concerning the collection of OASIS data as part of the comprehensive assessment (64 FR 3764), and an interim final regulation concerning transmission of OASIS data (64 FR 3748). On April 7, 1999, we notified home health agencies (HHAs), State survey agencies, Medicare and Medicaid beneficiaries, software vendors, and the general public through the OASIS website that we delayed the effective date of the OASIS data transmission requirement. On April 27, 1999, we notified HHAs, State survey agencies, Medicare and Medicaid beneficiaries, software vendors, and the general public through the OASIS website, that the mandatory use, collection, and encoding of OASIS were also delayed, due to lack of Paperwork Reduction Act (PRA) clearances. A notice to this effect was published in the Federal Register on May 4, 1999 (64 FR 23846). The appropriate PRA clearances have now been obtained and privacy procedures followed. Specifically, the PRA clearances for the final rule establishing OASIS collection and use, and the interim final rule for encoding and transmission have been obtained from the Office of Management and Budget (OMB) and approval numbers assigned. The respective OMB control numbers for these collections are 0938-0760 and 0938-0761 and the expiration dates are December 31, 1999. The Privacy Act System of Records (SOR) Notice has been carefully drafted in consultation with OMB and is published elsewhere in this Federal Register. II. OASIS Effective Dates Effective July 19, 1999, all HHAs participating in the Medicare/ Medicaid programs are required to initiate the use of the standardized assessment data set, OASIS, as summarized in the following chart: Summary of Mandantory Collection, Encoding, and Transmission Dates for Oasis ---------------------------------------------------------------------------------------------------------------- Transmission effective Patient classification Collection effective date Encoding effective date date ---------------------------------------------------------------------------------------------------------------- Medicare \1\/Medicaid \2\-- July 19, 1999............. July 19, 1999............. August 24, 1999. Skilled. Non-Medicare/Non-Medicaid July 19, 1999............. Spring 2000............... Spring 2000 \4\. \3\--Skilled. Medicaid \5\--Personal Care Spring 2000............... Spring 2000............... Spring 2000. Only. Non-Medicaid \3\--Personal Spring 2000............... Spring 2000............... Spring 2000 \4\. Care Only.Patients under age Excluded.................. Excluded.................. Excluded. 18; Patients receiving pre & post partum maternity services; Patients receiving only chore and housekeeping services. ---------------------------------------------------------------------------------------------------------------- \1\ OASIS item (M0150) Current Payment Sources for Home Care: response 1 or 2. \2\ OASIS item (M0150) Current Payment Sources for Home Care: response 3 or 4. \3\ OASIS item (M0150) Current Payment Sources for Home Care: response 0, 5, 6, 7, 8, 9, 10, 11, or UK. \4\ Data transmitted with masked identifiers \5\ OASIS item (M0150) Current Payment Sources for Home Care: response 3. III. Major Changes to OASIS We are initiating OASIS activities as outlined in this notice which include the following changes: Administration of a standard notification to patients of their privacy rights on admission to the HHA. The addition of language in the SOR explaining limitations on ``routine uses'' of data under the Privacy Act, so that personally identifiable data will only be used where statistical information is not sufficient. While this is usual practice, this language has not traditionally been included in SOR notices. Among other changes, personally identifiable data will no longer go to accrediting organizations such as the Joint Commission on Accreditation of Healthcare Organizations. Limiting the ``routine uses'' of data to other Federal and State agencies. Only those Federal and State agencies that (1) contribute to the accuracy of HCFA's health insurance operations including payment, treatment, and coverage, and/or (2) support State agencies in the evaluations and monitoring of care provided by HHAs will have access to OASIS data. Major changes to the application of OASIS to private-pay patients under OASIS. We have decided that information on non-Medicare and non-Medicaid patients will not be [[Page 32985]] transmitted to the States or HCFA in personally identifiable form. After careful attention to each question in OASIS, all questions but one were retained on the grounds of assuring quality of care and appropriate reimbursement. We did identify a sensitive question on patient financial factors that we consider less critical to achieving program goals, and this information will not be reported to HCFA or the States. Acceleration of efforts to encrypt data during transmission, to provide yet another level of protection. We expect to complete these efforts within a year. Delay and phase-in the requirement to collect, encode, and transmit OASIS data on patients receiving personal care only services until further notice. This allows States and associations to adjust to this requirement and allows us to evaluate issues pertaining to the content and frequency of OASIS data collection relative to other reporting requirements. IV. OASIS Effective Dates in Detail A. Medicare/Medicaid--Skilled Effective July 19, 1999, for Medicare/Medicaid patients receiving skilled services, HHAs must collect OASIS data as described in the final regulation published on January 25, 1999 (64 FR 3764) concerning use of the OASIS as part of the comprehensive assessment. This means that for all Medicare/Medicaid patients receiving skilled services, currently under the care of the agency or admitted to the agency on or after July 19, 1999, HHAs must conduct comprehensive assessments and updates at the required time points, and incorporate the OASIS data set. The exception to this requirement are those patients receiving prepartum and postpartum services, patients under age 18, and patients receiving only housekeeping/chore services. OASIS data collection for patients receiving only personal care services is delayed. HHAs must collect start of care OASIS data and updates at the required time points on new admissions to the HHA on or after July 19, 1999. In addition, HHAs must collect OASIS data on patients already in service. At the next appropriate time point, that is, resumption of care, follow-up (that is, every 2 calendar months), transfer to an inpatient facility (with or without agency discharge) and death at home, on or after July 19, 1999, HHAs must collect OASIS data on all Medicare/ Medicaid patients receiving skilled services. Effective July 19, 1999, for Medicare/Medicaid patients receiving skilled services, HHAs must encode and lock their OASIS data (that is, enter it into a computer), according to the requirements outlined in the interim final rule published January 25, 1999 (64 FR 3748) concerning transmission of OASIS data. This means that HHAs will encode and lock start of care OASIS data and updates at the required time points on new admissions to the HHA on or after July 19, 1999. In addition, HHAs must encode and lock OASIS data on patients already in service. At the next appropriate time point, that is, resumption of care, follow-up (i.e., every 2 calendar months), transfer to an inpatient facility (with or without agency discharge) and death at home, on or after July 19, 1999, HHAs must encode and lock OASIS data on all Medicare/Medicaid patients receiving skilled services. If the HHA patient's services are to be paid for by Medicare or Medicaid, the OASIS must be reported. There are no exceptions. Effective August 18, 1999, HHAs must have completed a successful transmission of test OASIS data. HHAs must successfully transmit test OASIS data to the State agency for the purpose of determining connectivity with the State OASIS system and receive a feedback report on the test data. On August 19, 1999, States will begin to purge all data on the State OASIS systems to allow for acceptance of production data. Beginning August 24, 1999, HHAs must begin the transmission of production OASIS data, that is, OASIS assessments completed, encoded and locked the previous month. EXAMPLE: June 18, 1999--Publication of Federal Register Notice July 19--August 18, 1999--Collection, encoding, and test transmission begins August 19-24, 1999--States purge test data August 25, 1999--Production transmission begins At least monthly thereafter, HHA transmissions must include all OASIS data collected, encoded, and locked in the previous month. B. Non-Medicare/Non-Medicaid--Skilled Effective July 19, 1999, for non-Medicare/non-Medicaid patients receiving skilled services, HHAs must conduct comprehensive assessments and updates at the required time points as described in the final regulation concerning use of the OASIS as part of the comprehensive assessment published on January 25, 1999 (64 FR 3764), incorporating the OASIS data set. HHAs must collect start of care OASIS data and updates at the required time points on new admissions to the HHA on or after July 19, 1999. In addition, HHAs must collect OASIS data on patients already in service. At the next appropriate time point, that is, resumption of care, follow-up (that is, every 2 calendar months), transfer to an inpatient facility (with or without agency discharge) and death at home, on or after July 19, 1999, HHAs must collect OASIS data on all non-Medicare/non-Medicaid patients receiving skilled services. However, we are not requiring encoding and transmission of OASIS data at this time. These assessments must be retained as part of the patient's clinical record in the HHA. We expect the effective date for encoding and transmission of OASIS data to begin in the Spring of 2000 for these patients. We will publish a notice in the Federal Register with instructions at that time. In the Spring of 2000, we will not expect HHAs to retroactively encode and transmit OASIS data collected between July 19, 1999 and the Spring of 2000. If a HHA mistakenly transmits identifiable non-Medicare/non- Medicaid data, we will reject this data at the State level. Rejection at this point ensures that the data will not get into the Federal data base until masking can be accomplished. When the requirement to encode and transmit non-Medicare/non- Medicaid patient data begins, HHAs must submit non-identifiable OASIS data on these patients to the State agency. In this way, care provided by the HHA can be evaluated for all patients of the agency, and not just Medicare/Medicaid patients. However, these data will be not be individually identifiable, but will be masked, as discussed below. C. Medicaid/Non-Medicaid--Personal Care Only For patients receiving only personal care services, regardless of payor source, the effective date for OASIS implementation will be in the Spring of 2000. We will publish a notice in the Federal Register with instructions at that time. This is a delay in the implementation of OASIS for these patients, which we originally outlined in the preamble language to the January 25, 1999, regulation concerning use of the OASIS as part of the comprehensive assessment. At this time, HHAs are not required to collect, encode and transmit OASIS data on patients receiving personal care or chore services unless skilled care is also provided. HHAs are required to collect, encode and transmit OASIS data [[Page 32986]] on patients who receive personal care and/or chore services only if they also receive skilled care as described above, in addition to the personal care services. We are delaying the requirement to allow States and associations to adjust to this requirement and allow us to evaluate issues pertaining to the content and frequency of OASIS reporting relative to other reporting requirements. In addition, this phase-in will allow HHAs more time to prepare, upgrade their systems and integrate the OASIS data set into their HHA and State specific instrument(s). D. Masking Masking refers to the concealing of individual data elements by the provider. Patient identifiable information is not known to HCFA or the OASIS State system. In OASIS terms, the data elements to be masked are patient's name, social security number, Medicare number, and Medicaid number. HHAs will keep the masked identifiers and the original data in their records. For non-Medicare/non-Medicaid patients, HCFA and other users will only be able to access data that does not contain any unique identifiers, including, no name, social security number, Medicare number and Medicaid number. With a consistent set of masked identifiers, we are still able to do the longitudinal data linking across patient care settings that is necessary for outcome measurement and targeting patients for sampling during the State survey agency certification review. At a minimum, we will follow the Federal Government FIPS 46-2 Data Encryption Standard (DES). Implementation of a masking system for non-Medicare/non-Medicaid OASIS data is expected to occur in the Spring of 2000. The steps required to accomplish this task include acquiring and evaluating tools that follow the FIPS 46-2 DES, developing system specifications required to incorporate the data masking tool, making the necessary program changes to the HCFA-provided HAVEN data entry software, as well as making other necessary changes to the OASIS State system and HCFA data specifications. For HHAs not using HAVEN, we are providing the opportunity for software vendors to make the required changes and properly test their software by posting these data specifications on the OASIS website in the near future. In addition, Year 2000 testing must take place after all program changes have been incorporated, to ensure that all systems are millennium compliant. Until such time as a system of masking patient identifiers is implemented, HHAs must assess and collect OASIS information from all patients as required by the regulation but only encode and transmit assessments with a Medicare/Medicaid payment source. To ensure only assessments with a Medicare/Medicaid payment source are received by the OASIS State system, the OASIS State system will reject all assessments with a non-Medicare/non-Medicaid payment source. E. Encryption HHAs are required to send OASIS assessment data for patients who have a Medicare or Medicaid payor source. Currently, these data are sent to the respective State via a private telephone line that connects directly into the OASIS State system. Although this is a relatively secure method, additional protection may be provided by using encryption. The use of 128-bit server certificates will provide strong encryption for all users who use either the domestic or export version of the latest leading browsers. HCFA plans to require this method in the near future. Several Federal agencies such as the U.S. Department of Commerce and the United States Postal Services have an expanded license to issue 128-bit serve digital certificates. A 128-bit encryption is standard for Netscape and Microsoft Internet Explorer, the two major web browsers. Both products are available free off the Internet or by mail for a nominal fee (less than $20.00). There are some system requirements to run these browsers. This includes a 32-bit operating system, that is, a computer that runs Windows 95, 98, or NT. HCFA's Y2K compliance requirements also require computers to have a 32-bit operating system. HHAs using the recommended computer system requirements described in the interim final regulations published on January 25, 1999 (64 FR 3738), concerning transmission of OASIS data will not require additional changes. The projected date for full 128-bit encryption transmission by HHAs is July 2000. V. More Background on Changes to OASIS A. Patient Rights Existing regulations at 42 CFR 484.10, Conditions of Participation: Home Health Agencies, specify that the patient has the right to be informed of his or her rights with respect to care provided by the HHA. Under the terms of this condition, HHA patients whose data will be collected and used by the Federal government must receive a notice of their privacy rights. These rights include: (1) the right to be informed that OASIS information will be collected and the purpose of collection; (2) the right to have the information kept confidential and secure; (3) the right to be informed that OASIS information will not be disclosed except for legitimate purposes allowed by the Federal Privacy Act; (4) the right to refuse to answer questions; and (5) the right to see, review, and request changes on their assessment. The statements of patient privacy rights with regard to the OASIS collection (one for Medicare/Medicaid patients, one for all other patients served by the HHA) are included in this notice. They will also be available via the HCFA Internet site (http://www.hcfa.gov). These statements may be revised in accordance with the OMB Paperwork Reduction Act reapproval process. Future revisions to these statements will be available via the HCFA Internet site (http://www.hcfa.gov) and in other instructional materials issued by HCFA. Consumer testing was undertaken to determine whether Medicare beneficiaries understood the overall message of the proposed Medicare notice. The findings indicated that beneficiaries understood that the notice was informing them about their rights relating to their personal health care information and that these protections were good. In addition, the majority of the beneficiaries found the notice's language to be clear and easy to understand. For Medicare/Medicaid patients, transmission of the assessment data to HCFA will be a condition for payment and an essential tool in ensuring that both programs are paying for quality health care services. As such, we are providing HHAs with a copy of the notice that HHAs must incorporate into their admission process. Notice to Medicare/Medicaid Patients HHAs must incorporate into their admission process for Medicare/ Medicaid patients Attachments A and B. Please refer to Attachment A-- Statement of Patient Privacy Rights (front), and Attachment B--Privacy Act Statement--Health Care Records (back) of this notice for this document. Notice to Non-Medicare/Non-Medicaid Patients Attachment C--Notice About Privacy for Patients Who Do Not Have Medicare or Medicaid Coverage. This is the notice that HHAs must incorporate into their admission process for non-Medicare/non-Medicaid patients. [[Page 32987]] B. Administering the Assessment The OASIS items should be answered as a result of the clinician's total assessment process, not completed as a checklist during an interview. Conducting a patient assessment involves both interview and observation. Many times the two processes complement each other. Information gained through interview is verified through observation. Many clinicians begin the assessment process with an interview, sequencing the questions to build rapport and gain trust and then proceed with observation. Others choose to start the assessment process with a familiar procedure such as taking vital signs to demonstrate clinical competence to the patient before proceeding to the interview. Very few OASIS data items rely solely on patient interview. In the rare instance that an assessment cannot be made due to lack of patient information, agencies must report the most appropriate response, based on their professional judgement. Patients should not be forced to cooperate with the assessment process. If patients refuse to answer some questions that are part of the OASIS assessment, the HHA may still deliver care to the patient as long as it completes and submits the OASIS assessment to the best of its ability. Some changes have been made to the OASIS User's manual with regard to the conventions involved in collecting and recording OASIS data in the context of the comprehensive assessment process, particularly for mental health assessments. These changes are available via the HCFA Internet site (http://www.hcfa.gov). Alternately, these changes can be accessed directly at www.hcfa.gov/medicare/hsqb/oasis/hhedtrng.htm which is where the entire OASIS User's manual is available for downloading free of charge. The purpose of these changes is to clarify the definitions, instructions, and assessment strategies for selected OASIS items, as follows: Pages 8.2 and 8.3 of the OASIS User's Manual have been modified to clarify the means of administering the OASIS items in the context of the comprehensive assessment. An introductory page (8.82) has been inserted into the Item-by-Item Tips section regarding the assessment of mental and emotional status, to provide further clarification concerning observational and interview techniques that are effective in eliciting the needed information while minimizing burden and intrusion on the patient. Item-by-item tips have been changed for item M0540 and items M0560 through M0620. The purpose of these changes is to emphasize observational techniques and to provide further guidance for clinicians in assessing these characteristics especially in situations where patients refuse to answer direct questions. C. Financial Factors Limiting the Ability of the Patient/Family to Meet Basic Health Needs (M0160) HCFA is not requiring the transmission of OASIS data item M0160 to the OASIS State system at this time. Because this data item assesses the patient's ability to meet basic health needs, the HHA may need this information to provide appropriate care. Therefore, HCFA requires the collection, assessment and encoding of this item. HCFA's data entry software (HAVEN Version 2.0) will blank out this encoded item as it is prepared for transmission to the OASIS State system. Additionally, the State system will reject this data item if it is inadvertently transmitted to the OASIS State system from software that does not meet HCFA specifications. Vendor software must be changed to accommodate this and other changes. This is discussed elsewhere in this notice. VI. Technical Information for HHAs and Vendors A. Medicare/Medicaid Patients At this time, HCFA requires the encoding and transmission of OASIS information on patients who are receiving Medicare/Medicaid benefits. This means that for patients who have selected a payor source of (1) Medicare (traditional fee-for-service), (2) Medicare (HMO/managed care), (3) Medicaid (traditional fee-for-service), or (4) Medicaid (HMO/managed care) on OASIS item M0150, the HHA must collect, encode and transmit all required OASIS information to the State agency. The payor source for services provided as part of a Medicaid waiver or home and community-based waiver (HCBW) program by a Medicare-approved HHA are coded as (3) Medicaid (traditional fee-for-service) at item M0150. B. Non-Medicare/Non-Medicaid Patients For non-Medicare/non-Medicaid patients, the HHA will only assess and collect OASIS as part of the comprehensive assessment and agency medical record. Until such time as we develop and implement a system to mask individual-level identifying data, encoding and transmission of OASIS data items is not required for patients with payor sources other than Medicare/Medicaid. Non-Medicare/non-Medicaid payor sources include private insurance, private HMO/managed care, self pay programs funded under the Social Security Act: for example, Title III, V, XX or other Government programs. C. Automation Information Software Changes Made The following section is of interest to software vendors and includes the changes that have been made to accommodate requirement changes for the OASIS: 1. HAVEN Software: HAVEN has changed the export function to allow the user to select Medicare/Medicaid only assessments, non-Medicare/ non-Medicaid assessments only, or all assessments. The HAVEN export function produces an ASCII text file from the HAVEN database. This file meets the OASIS data specifications that must be transmitted to the State agency. If a user selects Medicare/Medicaid only, as defined earlier, all assessments with a reason for assessment (M0100) value of 1, 2, 3, 4, 5, and 9 and a payment source (M0150) value of 1, 2, 3, or 4, as well as, all assessments with a reason for assessment (M0100) with a value of 6, 7, 8, and 10 will be selected for export. If a user selects non-Medicare/non-Medicaid only, as previously defined, all assessments with a reason for assessment (M0100) value of 1, 2, 3, 4, 5, and 9 and a payment source (M0150) value other than 1, 2, 3, or 4 will be selected for export. Therefore, the HHA controls assessments to be sent to the State agency. As stated previously in this notice, these procedures ensure that only assessments with a Medicare/Medicaid payment source are received by the OASIS State system as the OASIS State system will reject all assessments with a non-Medicare/non- Medicaid payment source. In addition to this change, HAVEN will blank out responses and move spaces to the Financial Factors data item (M0160) on all assessments prior to creating the export file. This data will remain in the original format in the HHA database but will exist as spaces at the State database. No data is collected at the State system on this item. 2. OASIS State System: The OASIS State system has been changed to reject any assessment with a reason for assessment (M0100) value of 1, 2, 3, 4, 5, and 9 and a payment source (M0150) value other than 1, 2, 3, or 4. The validation report will reflect that an [[Page 32988]] assessment meeting the above criteria has been rejected. In addition to this change, the OASIS State system will blank out and move spaces to the Financial Factors data (M0160) on all assessments prior to editing a file submitted by a HHA. This data will remain in the original format in the HHA database but as spaces at the State database. These changes in the HAVEN software are available via the HCFA Internet site (http://www.hcfa.gov) in our revised HAVEN software, version 2.0. Registered HAVEN users will be mailed a copy of the revised HAVEN software, version 2.0 by July. The following changes still need to be made to accommodate requirement changes for the OASIS data base: Software Changes Pending 1. HAVEN Software: The HAVEN software will need to incorporate all requirements to mask designated identifiers for any assessment with a reason for assessment (M0100) value of 1, 2, 3, 4, 5, and 9 and a payment source (M0150) value other than 1, 2, 3, or 4. Specifications for this are scheduled to be available via the HCFA Internet site (http://www.hcfa.gov) by July 1, 1999, and scheduled to become effective in April 2000. 2. OASIS State System: The OASIS State system will make the necessary edits to reject any assessment with a reason for assessment (M0100) value of 1, 2, 3, 4, 5, and 9 and a payment source (M0150) value other than 1, 2, 3, or 4 that does not have the designated identifiers masked. This edit is scheduled to be effective in April 2000. HCFA Websites Revisions and updates to OASIS implementation will be available via the HCFA Internet site (http://www.hcfa.gov). Alternatively, the OASIS Internet site is accessible directly at the following address: www.hcfa.gov/medicare/hsqb/oasis/oasishmp.htm. This is the OASIS home page. A summary of OASIS website content is available at this site. OMB Review In accordance with the provisions of Executive Order 12866 this document was reviewed by the Office of Management and Budget. (Catalog of Federal Domestic Assistance Program No. 93.778, Medical Assistance Program; No. 93.773 Medicare--Hospital Insurance Program) Dated: June 11, 1999. Nancy-Ann Min DeParle, Administrator, Health Care Financing Administration. BILLING CODE 4120-03-P [[Page 32989]] [GRAPHIC] [TIFF OMITTED] TN18JN99.001 [[Page 32990]] [GRAPHIC] [TIFF OMITTED] TN18JN99.002 [[Page 32991]] [GRAPHIC] [TIFF OMITTED] TN18JN99.003 [FR Doc. 99-15529 Filed 6-16-99; 9:00 am] BILLING CODE 4120-03-C