Medicare Home Health Care: OASIS Data Use, Cost, and Privacy Implications
(Letter Report, 01/30/2001, GAO/GAO-01-205).
With the Health Care Financing Administration's (HCFA) implementation of
a prospective payment system, efforts to protect patients from potential
underprovision of care and to hold home health agencies (HHAs)
accountable are essential. Instituting the collection and reporting of
Outcome and Assessment Information Set (OASIS) data is an important step
in that direction. The use of OASIS data enhances consistency in the
performance and documentation of patient assessments for home health
services. As a result, information on patient outcomes will become
available for the first time. Collecting such data is not without its
costs. To varying degrees, the requirement to collect OASIS data on all
home health patients increases the amount of staff time devoted to
collecting and reporting patient assessment information. HHAs have been
compensated for some of these costs through adjustments made to their
payment rates. Moreover, because prospective payment system episode
payment rates are based on historically high utilization levels, which
have since declined, these rates should allow the completion of OASIS
assessments. Protecting the privacy of home health care patients is also
important. HCFA has made progress in this area by enhancing protections
in the collection and transmission of the OASIS data. The effectiveness
of these policies and procedures will depend on how well they are
implemented.
--------------------------- Indexing Terms -----------------------------
REPORTNUM: GAO-01-205
TITLE: Medicare Home Health Care: OASIS Data Use, Cost, and
Privacy Implications
DATE: 01/30/2001
SUBJECT: Health insurance
Health care programs
Medical records
Reporting requirements
Computer security
Performance measures
Internal controls
Confidential communication
Privacy law
Home health care services
IDENTIFIER: Medicare Program
HCFA Outcome and Assessment Information Set
Medicare Prospective Payment System
******************************************************************
** This file contains an ASCII representation of the text of a **
** GAO Testimony. **
** **
** No attempt has been made to display graphic images, although **
** figure captions are reproduced. Tables are included, but **
** may not resemble those in the printed version. **
** **
** Please see the PDF (Portable Document Format) file, when **
** available, for a complete electronic file of the printed **
** document's contents. **
** **
******************************************************************
GAO-01-205
Report to Congressional Committees
United States General Accounting Office
GAO
January 2001
medicare home health care
OASIS Data Use,
Cost, and Privacy Implications
Home Health Data Requirements
[0x08 graphic]
[0x08 graphic]
[0x08 graphic]
Contents
Letter 1
Appendix I Methodology for Survey of Home Health Agencies
Tables
Table 1: Percentage of All Agencies, Sample Agencies, and Survey Respondents
with Selected Characteristics
Abbreviations
BBRA Medicare, Medicaid, and SCHIP Balanced Refinement Act of 1999
CHSPR Center for Health Services and Policy Research
HCFA Health Care Financing Administration
HHA home health agencies
IPS interim payment system
MDCN Medicare Data Communications Network
OASIS Outcome and Assessment Information Set
PPS prospective payment system
VNA Visiting Nurse Association
United States General Accounting Office
Washington, DC 20548
[0x08 graphic]
[0x08 graphic]
January 30, 2001
Congressional Committees
Although millions of Medicare beneficiaries receive home health care each
year, little is known about the specific services provided during home
health visits or their impact on patient outcomes. In addition, from 1990 to
1997 both the number of beneficiaries and the amount of services they
received increased sharply, raising concerns about Medicare expenditures and
the appropriateness of services being provided. As early as 1987, the
Congress began to address the need for greater oversight of home health care
by requiring that the Health Care Financing Administration (HCFA) implement
an outcome-based quality monitoring system. Ten years later, to address the
mounting cost of home health care, the Congress directed HCFA to develop a
new payment system for home health care that would shift from cost-based
reimbursement to a prospective payment system (PPS).
As part of fulfilling both of these provisions, HCFA has begun requiring
home health agencies (HHA) to collect and report data on all their patients
using a standardized assessment instrument known as the Outcome and
Assessment Information Set (OASIS). However, HHAs have expressed concern
that the OASIS data collection requirement is overly burdensome. Also, some
patients' rights advocates contend that the confidentiality of individual
patient information may not be adequately protected. HCFA officials respond
that the OASIS data are essential to accurately monitor home health care
quality and to implement plans to achieve quality improvements, as well as
to determine payments for individual patients. Furthermore, the agency has
said that the cost and privacy implications of using OASIS are minimal.
The Medicare, Medicaid, and SCHIP Balanced Budget Refinement Act of 1999
(BBRA) mandated that we examine the cost and privacy concerns associated
with OASIS data collection requirements. We addressed the following key
questions in our review:
1. How does HCFA plan to use the OASIS-generated information?
2. Since the implementation of OASIS, have patient assessments changed and
have additional costs been incurred by HHAs?
3. What has HCFA done to safeguard the confidentiality of OASIS data?
To answer these questions, we interviewed industry representatives, home
health experts, HCFA and state officials, and state surveyors in several
states. We also obtained perspectives on OASIS implementation by visiting
several HHAs in urban and rural areas and interviewing agencies with
reputations for high-quality practices. Because reliable data are not
available, we could not obtain a comprehensive accounting of all possible
costs associated with complying with the OASIS mandate. Rather, we conducted
a survey of a representative sample of 50 HHAs regarding ongoing
OASIS-related costs beyond those that the HHAs previously incurred for
patient assessments. We asked specifically for the agencies' estimates of
changes in staff time for data collection and reporting and for training new
staff. (For more detail on our survey methodology, see app. I.) Finally, we
reviewed relevant documents, including HCFA regulations and manuals. Our
review was conducted from May 2000 to November 2000 in accordance with
generally accepted government auditing standards.
[0x08 graphic]
Results in Brief
OASIS has two primary functions: monitoring the quality of home health care
and adjusting Medicare payments to account for differences in patient
characteristics. HCFA plans to use OASIS data to help target its oversight
of the quality of HHA activities and to provide standardized information on
quality to HHAs. HHAs, in turn, can use OASIS information to determine the
extent to which their patients experience positive outcomes and compare
their performance levels with national benchmarks. OASIS data are also used
by HCFA to calculate Medicare payments for each episode of care and to
refine the adjustment factors needed to determine relative payment rates
under the home health PPS.
The use of OASIS has made the documentation of home health patient
information more consistent, while adding time for assessment-related
activities. The incorporation of the OASIS instrument into all initial
patient assessments has meant that HHAs generally collect data in a more
consistent fashion than in the past. Previously, HHAs were required to
perform an initial comprehensive assessment and may have documented their
findings in a variety of ways, often with narrative summaries. In contrast,
OASIS involves a set of standardized questions to be completed by choosing
from a list of responses that can substitute for most of the narrative.
Based on a survey of clinicians in several HHAs, HCFA estimated that using
OASIS would not add to the time it took HHAs to conduct their start-of-care
assessments. However, the respondents in a random sample of HHAs we surveyed
estimated an increase in time for patient assessments following the
implementation of the OASIS mandate. These HHAs also reported additional
costs associated with verifying and transmitting the data to HCFA, as well
as with training new hires to collect OASIS data.
In response to privacy concerns raised before the implementation of the
OASIS requirements, HCFA announced several safeguards aimed at protecting
the confidentiality of patient information. At admission, HHAs must provide
all patients with a written notice of their privacy rights. Also, although
HHAs must collect information on patients' financial condition, HCFA
eliminated the requirement for HHAs to transmit such information to data
repositories. Additionally, it announced that for non-Medicare/Medicaid
patients, several OASIS patient identifiers will be masked. As we previously
reported, however, routine monitoring of users of confidential information,
such as OASIS data, would improve the privacy protections afforded home
health care patients.
In commenting on a draft of this report, HCFA agreed with our findings and
conclusions.
[0x08 graphic]
Background
Medicare's home health care benefit enables beneficiaries with
post-acute-care needs and chronic conditions to receive certain skilled
nursing, therapy, and aide services in their homes rather than in other
settings. To qualify for Medicare's home health benefit, a beneficiary must
be confined to his or her residence (homebound), must be under a physician's
care, and must require physical therapy, speech therapy, continued
occupational therapy, or skilled nursing on an intermittent basis.
Beneficiaries are not liable for any coinsurance or deductibles for these
services and may receive care as long as they meet the eligibility criteria.
Until recently, Medicare has reimbursed HHAs for their costs, subject to
limits, for services they provide to the program's beneficiaries.
Between 1990 and 1997, Medicare expenditures for home health services went
up three times faster than spending for the program as a whole. This rapid
rise has been attributed to many factors, including a liberalization of home
health benefit criteria and a lack of sufficient controls to protect the
program from potential billing practice abuse. In combination, these factors
created conditions where providers could deliver more services than
necessary to beneficiaries in order to increase their revenues. In response
to these problems, the Balanced Budget Act of 1997 required, by October 1,
1999, the implementation of a new home health PPS, and, until then, the
implementation of an interim payment system (IPS) to slow spending growth.
The IPS incorporated tighter per-visit cost limits than previously in place
and subjected each agency to an annual Medicare revenue cap (based on a
per-beneficiary amount and the number of patients it served).
The home health PPS, which replaced the IPS on October 1, 2000, is designed
to align payments with anticipated service needs. HHAs now receive a single
payment for each 60-day episode of care for a Medicare beneficiary. The base
payment is adjusted to reflect patient characteristics that have been shown
to affect service use. For fiscal year 2001, the base amount per episode has
been set at $2,115, but payment rates range from about $1,100 to nearly
$6,000, depending on the functional and clinical severity of each
beneficiary. Each episode payment is adjusted for differences in labor costs
across geographic areas, and certain extremely high cost episodes receive
outlier payments. Once the payment is determined, the amount of service
provided to that beneficiary does not change the amount of reimbursement.
In order to qualify as providers eligible to bill Medicare for home health
services, HHAs have to comply with the program's conditions of
participation. These standards seek to ensure that HHAs have the appropriate
staff, policies, procedures, medical records, and operational practices to
deliver acceptable quality care. HCFA contracts with state survey and
certification agencies to oversee the adherence of HHAs in their states with
these standards. However, our previous work has shown that state agencies'
reviews of HHAs to be certified to provide Medicare services did little to
ensure quality care and that there was almost no oversight of the actual
care provided to home health patients.
In the Omnibus Budget Reconciliation Act of 1987, Congress mandated that
HCFA develop a standardized patient assessment instrument to assist in
monitoring HHAs. HCFA used information from years of research and
demonstrations in the development of OASIS, which contains 79 demographic,
clinical, and functional data items for assessing patients and measuring
outcomes. (The process of developing and testing OASIS is described in app.
II.) In January 1999, HCFA issued final rules requiring HHAs to conduct
comprehensive patient assessments incorporating the OASIS data elements and
electronically report the OASIS data collected. The requirement covers most
private pay as well as Medicare and Medicaid patients. Collection of the
information relies on both observation of patient function by a nurse or
therapist and patient responses. For each patient receiving skilled care,
the data are generally collected at the initial visit, every 60 days
thereafter for the duration of treatment, and at discharge. HHAs report the
data to their state survey and certification agencies, which then report the
data to a central repository maintained by HCFA.
Concerns regarding the privacy of OASIS information were expressed shortly
after HCFA issued its rules on OASIS data collection and reporting in
January 1999. Some privacy advocates expressed concerns that some questions
were irrelevant or delved too deeply into the personal lives of patients.
They cited the mental status questions, including one that asks about
depressive feelings reported or observed in the patient, as well as a
question regarding financial factors that could limit the patient's ability
to meet his or her own basic health needs.
HHAs, advocacy groups, and others suggested that patient identifiers be
removed from OASIS data before transmission to HCFA or that HCFA not require
OASIS data to be reported on non-Medicare/Medicaid patients. In the spring
of 1999, these concerns led HCFA to postpone the effective date of OASIS
reporting until it reviewed the privacy issues involved. The outcome of this
review was HCFA's decision to leave the OASIS assessment instrument intact.
HHAs would continue to be required to collect all OASIS information on all
patients, because HCFA believes it is valuable to HHAs in patient
assessments and care planning. However, HCFA put limits on the transmission
of certain OASIS data elements, and it has postponed data reporting, but not
collecting, for non-Medicare/Medicaid patients.
Under the new conditions of participation effective July 1999, HHAs
participating in Medicare must (1) incorporate OASIS data items into the
assessment process for Medicare, Medicaid, and private pay patients, (2)
electronically transmit accurate OASIS data to the state survey agency or
HCFA OASIS contractor, and (3) maintain the privacy of their OASIS data.
[0x08 graphic]
OASIS Designed for Quality Monitoring and Payment Purposes
The OASIS data instrument serves both to monitor home health care quality
and to adjust payments to account for differences in patient
characteristics. To enhance quality of care, HCFA plans to use the OASIS
data to guide its oversight of HHA activities, to provide each HHA with
information about its patients' outcomes compared to those of other HHAs,
and to guide the selection of HHAs by patients and physicians. OASIS data
affect payments to HHAs both in determining the payment made for current
patients and in providing data to analyze possible modifications to the
current payment system.
[0x08 graphic]
OASIS Data Intended to Improve Medicare Oversight and HHA Practices
HCFA proposes to use OASIS data to promote higher-quality home health care
by (1) guiding the oversight of HHAs performed by state survey and
certification agencies, (2) giving HHAs comparative information that they
can use to improve their own practices, and (3) providing information to
patients and referring physicians that will help them to choose HHAs that
achieve better outcomes. Although none of these approaches has been
implemented, planning for the first two is under way, and the third is to be
developed in the future.
HCFA intends to use OASIS data to strengthen its oversight of state survey
agency monitoring of HHA outcomes. It requires the state survey agencies to
examine the OASIS data in preparation for surveys of individual HHAs. Survey
agencies have begun checking the OASIS data submitted by HHAs in their
states to ensure HHA compliance with OASIS reporting requirements. HCFA
expects the survey staff to review OASIS-based reports to identify
indicators of potential concern (such as high rates of infection) that would
warrant further investigation and ongoing monitoring.
When HCFA mandated that HHAs begin collecting OASIS data, it emphasized that
this requirement was intended to set in motion a process of continuous
quality improvement within each HHA. Based on the OASIS data collected, each
HHA will be granted electronic access to customized reports displaying its
own patients' outcomes in relation to those of home health patients
nationally, with statistical adjustments to take account of the clinical
characteristics of the patients served by that agency. The HHA will be able
to examine outcomes for specific types of care (such as wound care and pain
management) and types of patients (such as those with diabetes or those
recovering from surgery). This way, each agency will be able to assess its
performance over time and compare it to national benchmarks. These reports
will enable HHAs to identify areas where their performance was suboptimal
and thus provide a basis for planning initiatives to improve patient health
status.
The first reports, based on the OASIS data that have been collected
nationwide since July 1999, show individual HHAs the demographic and
clinical profiles of their patient population and adverse events. These
reports are expected to be available by late January 2001, followed by
detailed risk-adjusted outcome reports in 2002. Before the reports are made
electronically accessible to the HHAs, OASIS education coordinators in each
state will provide training and technical assistance for HHAs on how to
analyze and act on the information. In addition, HCFA has funded a 2-year
pilot project in five states to explore the feasibility of using peer review
organizations to help HHAs in interpreting their reports and developing from
them effective quality improvement initiatives.
Another way HCFA plans to use OASIS data to promote quality is by providing
information to assist physicians and patients in selecting HHAs. HCFA
expects that making such comparative information on outcomes publicly
available could encourage HHAs to compete for patients on the basis of the
quality of care they provide. HCFA has recently initiated planning on how to
release this information. The first step will be to evaluate alternative
approaches for presenting and distributing these data to the public. One
current example of HCFA's efforts to share comparative information on
Medicare providers is its Nursing Home Compare Web site. This site has
information on facility and resident characteristics of nursing facilities
as well as deficiencies reported in past survey inspections, though not on
patient outcomes.
[0x08 graphic]
OASIS Data Critical to Adjusting HHA Payments and Improving PPS Formulas
A second major use of OASIS data collection is payment-related. Under the
home health PPS, HHAs receive a specified payment per beneficiary for each
60-day episode of care. HCFA uses OASIS data to assign patients to one of 80
relative payment levels, called home health resource groups. This assignment
is based on 23 patient descriptors from the OASIS assessment that measure
clinical condition, functional status, and service utilization. Each payment
group is assigned a relative weight that reflects the cost of the average
beneficiary in that category relative to all home health care users.
In addition to providing information necessary to implement the home health
PPS in its current form, OASIS data will assist HCFA in (1) monitoring the
effects of prospective payment on quality of care and (2) developing
potential refinements in the formulas used to determine payments. Because of
the change from cost-based reimbursement to prospectively determined
payments for each episode of care, PPS creates a financial incentive to
limit services per episode and increase the number of episodes billed. HCFA
has pledged to undertake monitoring of OASIS data, along with data from
other monitoring systems, as part of a surveillance system designed to
assess the short- and long-term effects of PPS. For example, OASIS data
should enable HCFA to detect unfavorable trends in outcomes for home health
care patients, such as delayed or diminished recovery from a stroke.
Questions have been raised about the potential vulnerability of the OASIS
data to manipulation intended to maximize provider payments. HHAs could
benefit financially from making their patients appear as sick and
functionally impaired as possible when initially assessed, in order to be
assigned a higher payment group. HCFA was aware of the risk of gaming and
sought to minimize this risk when it selected the specific OASIS data
elements used to assign patients to different PPS payment groups. The
Medicare Payment Advisory Commission has nonetheless expressed concern that
the OASIS assessments submitted to HCFA will reflect these financial
incentives to exaggerate patient severity at admission. To address concerns
about data quality, HCFA has undertaken an accuracy demonstration program.
This program will evaluate alternative methods to ensure the accuracy of the
OASIS data submitted by HHAs. In addition, state surveyors will check a
sample of patient assessments against medical records.
Medicare fiscal intermediariescontractors to HCFA that process HHA claims
for paymentare also expected to use OASIS data. The information will help
them decide which HHAs to include in focused medical reviews that determine
the appropriateness of payment of individual claims for home health services
provided to beneficiaries. One aspect of this review strategy involves
determining whether OASIS information is supported by documentation in the
medical record. If the intermediaries determine that the OASIS data are not
appropriate, they will adjust the payment grouping accordingly.
[0x08 graphic]
Almost All OASIS Data Elements Collected Will Be Used for Quality or Payment
Purposes
HCFA has sought to limit the amount of OASIS data collected to that needed
for monitoring quality and payment purposes. The research group that
developed OASIS under contract to HCFAthe University of Colorado Center for
Health Services and Policy Research (CHSPR)explicitly set out to identify
the key data elements that would enable HHAs to measure their outcomes while
minimizing the data collection burdens. CHSPR identified a set of 73 core
data items needed both to compute quality indicators and to risk-adjust the
outcomes reported. (See app. II for more details on this process.) An
advisory group appointed by HCFA reviewed CHSPR's core data set. This
Standard Assessment work group was made up of 13 members, including HHA
administrators, practicing clinicians, a clinical assessment expert, a state
official, and representatives of industry and professional organizations. It
recommended that HCFA adopt the core data set, with the addition of several
more elements. The feasibility of collecting and using OASIS data was
subsequently tested in two demonstration studies that documented improved
outcomes for the participating HHAs.
Nearly all the OASIS data elements that emerged from this process will be
used to generate the specific outcome measures presented in the HHA
customized quality improvement reports. Six of the 79 items currently have
no intended use. Four of these, described as potential risk adjustment
factors, assess environmental and safety issues in the patient's home, and
another item relates to the patient's financial ability to meet treatment
needs. All four were among those added to the data set at the behest of
HCFA's advisory work group. Concerns were subsequently raised by some
privacy advocates about the sensitivity of some of these data elements. The
financial question in particular was so sensitive that HCFA decided to
exclude it from the data transmitted by the HHAs to the states. However,
HCFA maintained the obligation of the HHAs to obtain this information for
all home health patients.
HCFA also required the HHAs to collect, but not initially transmit, OASIS
information on patients receiving skilled care who were not covered by
Medicare or Medicaid. HCFA has stated that it is important to collect OASIS
data on patients served by HHAs from all payor sources in order to evaluate
the quality of care provided. In addition, HHS must ensure that the
conditions of participation are adequate to protect all individuals under
the care of the HHA. Although HCFA has developed techniques for masking the
identity of non-Medicare/Medicaid patients, it has postponed having these
data transmitted to the state repositories. HCFA officials told us that the
notice to begin transmission of these data could be published in the spring
of 2001. HCFA will not, however, require retroactive transmission of the
OASIS data collected from non-Medicare/Medicaid patients. Instead, HCFA will
notify HHAs to transmit only current assessments on non-Medicare/Medicaid
patients.
[0x08 graphic]
Assessments More Consistent Using OASIS, but HHAs Say Requirements Add Time
Incorporating the OASIS data instrument into comprehensive patient
assessments has increased the consistency of patient data collected by the
HHAs. In contrast to HCFA's expectation that HHAs would take no more time to
conduct start-of-care visits using OASIS, nearly all respondents in our
survey of HHAs estimated that start-of-care visits take longer than they did
before. These HHAs also reported that additional time is needed to check and
edit collected OASIS data, enter and transmit the information
electronically, and train new staff.
[0x08 graphic]
OASIS Mandate Requires More Consistent Documentation of Patient Assessments
The initiation of home health care requires two separate but related steps:
performing a comprehensive assessment of the patient's condition and, based
on that assessment, devising the patient's plan of care. Before the OASIS
mandate took effect, Medicare rules required HHAs to perform both of these
steps, but called for specific documentation for the plan of care only. Now
they require the collection and reporting of the OASIS assessment data for
each patient as well as plan-of-care documentation. Thus, what constitutes a
comprehensive assessment under the long-standing requirement is now more
clearly defined for HHAs.
According to HHA and state officials, the assessments that HHAs performed in
the past varied in both scope and format. They told us that while some
agencies may have conducted thorough evaluations of their patients, others
performed more cursory or narrowly focused assessments. Likewise, HHA
documentation practices could vary substantially. For example, some agencies
wrote narrative descriptions of the patient's condition, and others may have
developed more structured instruments with short answers or checklists. The
effect of the OASIS mandate on each HHA depended on how different its
previous practices in conducting and documenting patient assessments were
from the current OASIS data collection and reporting requirements.
[0x08 graphic]
OASIS Requires Additional Time for Multiple Activities
HCFA has cited data from selected HHAs in an OASIS demonstration project to
support its expectation that OASIS' standardized, multiple-choice format
would take no more time to complete than prior documentation of assessments,
which typically involved individual narratives. However, data we collected
through interviews and a survey of HHAs suggest that OASIS did result in an
increase in time spent in initial care visits and additional time for new
tasks associated with transmission of data.
To provide a basis for cost estimates, as required by regulation, HCFA asked
CHSPR to assess the OASIS data collection costs on HHAs, in particular the
additional staff time required. Of special concern was the start-of-care
comprehensive assessment, when clinicians would have to obtain answers to
all the OASIS questions from a new patient for the first time.
CHSPR gathered data from 10 agencies participating in a HCFA-sponsored
study. Overall, CHSPR found that the median total time taken by these HHAs
for start-of-care visits using OASIS was 150 minutes, a few minutes less
than start-of-care visits without OASIS. In a second study, Abt Associates
measured the time taken for start-of-care visits with a longer version of
OASIS, but recorded only the time spent in the patient's home and not time
spent on associated paperwork performed elsewhere. This study of more than
20,000 visits found that start-of-care visits using OASIS required a median
of 90 minutes. However, there were no comparable data from start-of-care
visits without OASIS.
In contrast to the CHSPR study, officials of the 32 agencies responding to
our survey of a representative sample of Medicare HHAs estimated that
start-of-care visits incorporating OASIS assessments did take more time than
those conducted prior to OASIS. The median total time estimated to complete
start-of-care visits with OASIS was 150 minutes, matching the figure
obtained in the CHSPR study. However, HHAs reported that this amount
represented a median increase of 40 minutes relative to time for
start-of-care visits prior to OASIS.
In each of these studies, data from individual HHAs on the amount of time
required for start-of-care visits with OASIS varied widely. This variation
may reflect differences in how responding HHAs have integrated the new
assessment instrument and how it is administered in the patient's home. Many
of the HHAs we interviewed told us that they had followed HCFA's
instructions to replace items requesting similar information on their
patient assessment forms with OASIS items. However, one agency had not yet
completed this task, requiring the nurse conducting an initial visit to
complete the OASIS form separately. To varying degrees, clinicians
administer the OASIS assessment through a combination of questioning,
examining the patient, and observing patient behavior and home environment.
HHAs also have to perform new tasks related to the submission of OASIS data
to the state repositories in electronic form. Both the mandate for HHAs to
collect and report OASIS data and the transition to prospective payment
based on OASIS information have heightened the concern of HHAs with the
validity and completeness of these data. To help ensure that patient
assessments are correctly recorded in a form that HCFA's data repositories
will accept, HHAs need to review the data as they proceed from initial
recording by the clinician to electronic transmission to the state
repository. The steps in this process include the following:
* Heightened supervisory review of the assessment forms completed by the
clinician performing the assessment.
* Entering, rechecking, and correcting OASIS data from paper records into
the computerized records.
* Batching and then electronically transmitting the data to a centralized
state data repository. (The transmission protocol established by HCFA
rejects data that do not pass tests for consistency and validity. Any
data rejected have to be analyzed, corrected, and resubmitted.)
The HHAs we surveyed estimated that these steps require approximately 50
minutes per OASIS assessment.
HHAs must also commit resources to training newly hired clinicians on OASIS
protocols. Eighty-four percent of our survey respondents said they provide
training for newly hired staff, with modules focused specifically on OASIS
data collection and documentation. Those HHAs offering OASIS-related
training reported providing a median of 8 hours to new staff. However, how
much additional time is due specifically to the OASIS requirement is not
clear, because OASIS-related training could substitute for some prior
assessment-related training as well as add new elements.
Many HHAs may find that their additional OASIS-related costs are offset by
payments they receive under the new payment system. We recently reported
that PPS payment rates are based on 1998 rates of home health care
utilization, which have since declined. Therefore, they are likely to be
generous in comparison with current use patterns. In our view, the episode
payments could provide an ample cushion for many agencies, which can be used
to offset the costs associated with the OASIS mandate.
In addition, Congress and HCFA have taken several actions to assist HHAs in
complying with OASIS mandates. For example, for each Medicare beneficiary
served from October 1, 1999, to September 30, 2000, Congress provided HHAs
with $10 to help defray OASIS costs. Also, the prospective payment base was
increased by $4.32 per 60-day episode as an ongoing adjustment for OASIS
reporting costs. HCFA has taken other steps to reduce the costs imposed on
HHAs by the OASIS mandate. These include the development and distribution
free-of-charge to HHAs of a software program (called HAVEN) to use in
transmitting the OASIS data to state agencies. HCFA has also provided
toll-free telephone lines to the HHAs for this data transmission.
[0x08 graphic]
HCFA's Data Safeguards Aim to Ensure Patient Privacy
HCFA has instituted several policies and procedures to protect OASIS data
from unauthorized access, conceal the identity of patients, and ensure that
recipients of OASIS information protect confidentiality. HCFA officials
believe that these actions provide reasonable assurance that the privacy of
OASIS information will not be compromised. As we previously reported,
ensuring that users of confidential health data, including OASIS data,
comply with required privacy procedures is also a necessary safeguard.
[0x08 graphic]
Safeguards Established to Prevent Unauthorized Access to Patient Information
As with all patient medical data, HHAs must ensure the privacy of OASIS
information. Even before OASIS was mandated, HHAs participating in Medicare
had to develop policies and procedures to maintain the confidentiality of
patient information. Several state surveyors we interviewed said that, as
part of their inspections, surveyors examine how all patient records,
including the OASIS forms, are maintained in the HHA's administrative
offices.
The new privacy requirements under Medicare conditions of participation call
for the HHA (and any agent acting on its behalf, such as a software vendor)
to ensure the confidentiality of all patient information contained in the
clinical record, including OASIS data. This requirement also prohibits the
HHA and its agents from releasing patient-identifiable OASIS information to
the public. In addition, HHAs are required to provide beneficiaries and
other patients with an OASIS statement of privacy rights upon admission to
the HHA. These OASIS privacy notices inform patients about their rights
relating to their personal health information, in language that is intended
to be clear and easy to understand. HCFA reported that consumer testing of
Medicare beneficiaries indicated that they understood that the notice was
informing them about their rights relating to their personal health care
information.
HCFA has also implemented data transmission and storage policies to protect
the information while it is in transit to, and being stored at, state
agencies and HCFA. These mechanisms include required use of a secure
communications network to protect the data while in transit, as well as
technology designed to make information unintelligible should unauthorized
persons access it. Further, HCFA requires that certain patient identifiers
associated with non-Medicare/Medicaid patients be masked so that state
agencies and HCFA will be unable to determine the identity of these
individuals. Although HCFA has developed techniques for masking the identity
of patients, it has postponed having these data transmitted to the state
repositories. Similarly, HHAs are not to transmit the response to the
question as to whether the patient has sufficient financial resources to pay
for medicine, food, and other essentials. (Details about HCFA's data
transmission and storage protections are discussed in app. III.)
Once the OASIS information is transmitted to HCFA, it is maintained in a
national repository, where specific disclosure policies apply. HCFA is bound
by the requirements of the federal Privacy Act (P.L. 93-579) in protecting
the confidentiality of all health information on beneficiaries, including
OASIS information. The Privacy Act allows the disclosure of information
without an individual's consent for routine uses that are consistent with
the purposes for which the information was originally collected. The routine
uses of OASIS information include aiding in the administration of the HHA
survey and certification process.
Persons who request OASIS data, such as researchers and members of peer
review organizations, must agree to protect the confidentiality of the
information as part of a written data use agreement. Data use agreements
must also be in place between HCFA regional offices and the state's Medicaid
agency before the state's OASIS agency can release the information to the
Medicaid agency. In addition, HCFA officials told us that it is departmental
policy to release only the minimum necessary data to meet the requester's
purpose.
[0x08 graphic]
Privacy Protections Could Be Further Enhanced
HCFA believes that the policies and procedures it currently has in place
provide it with reasonable assurance that the confidentiality of any OASIS
information released to approved entities will be maintained. However, in a
July 1999 report we identified several weaknesses in HCFA's privacy
practices that could potentially compromise the confidentiality of health
information on Medicare beneficiaries. Although we found that HCFA's
policies and procedures regarding disclosure of personally identifiable
information were generally consistent with the provisions of the Privacy
Act, weaknesses in the implementation of these policies raised concerns. For
example, we found that HCFA was not always clearly informing beneficiaries
of the purposes for which their information may be disclosed, as required by
the Privacy Act. We also found that HCFA did not routinely monitor
contractors and others, such as researchers, who use personally identifiable
Medicare information. We recommended that HCFA take steps to address these
weaknesses.
HCFA has taken steps regarding protection of its OASIS data. As stated
above, HCFA has required HHAs to provide both Medicare/Medicaid and private
pay patients with OASIS privacy notices. The beneficiary notice lists the
patient's primary rights and gives the patient information as required by
the Privacy Act, such as HCFA's authority for collecting OASIS data and the
principal purposes for which the information would be routinely used.
However, based on our discussions with HCFA and state officials, there
appears to be little or no oversight of how effectively the state agencies
and third parties are maintaining the privacy of OASIS information. Even
though HCFA requires state agencies to ensure that access to OASIS data is
restricted and that recipients of OASIS information protect its
confidentiality, HCFA officials told us that they do not inspect the privacy
safeguards in place at the state agency. These officials also indicated that
HCFA still has no system in place to monitor whether parties subject to data
use agreements are complying with their requirements. Without an adequate
monitoring system in place, HCFA could be hampered in its attempts to
prevent the occurrence of problems and provide timely information and
corrective action for any that might occur.
[0x08 graphic]
Concluding Observations
With the implementation of a prospective payment system, efforts to protect
patients from potential underprovision of care and to hold HHAs accountable
are essential. Instituting the collection and reporting of OASIS data is an
important step in that direction. The use of OASIS data enhances consistency
in the performance and documentation of patient assessments for home health
services. As a result, information on patient outcomes will become available
for the first time.
Collecting such data is not without its costs. To varying degrees, the
requirement to collect OASIS data on all home health patients increases the
amount of staff time devoted to collecting and reporting patient assessment
information. HHAs have been compensated for some of these costs through
adjustments to their payment rates. Moreover, because PPS episode payment
rates are based on historically high utilization levels, which have since
declined, these rates should allow the completion of OASIS assessments.
Protecting the privacy of home health care patients is also important. HCFA
has made progress in this area by enhancing protections in the collection
and transmission of the OASIS data. The effectiveness of these policies and
procedures will depend on how well they are implemented.
[0x08 graphic]
Agency Comments
We provided a draft of this report to HCFA for review. It its comments, HCFA
agreed with our findings and conclusions and elaborated on several points
addressed in the report. HCFA continues to believe that, once HHA staff
learn how to implement OASIS, the amount of time it takes to conduct a
thorough patient assessment will decline. The agency contends that, as
experience with OASIS is gained, HHAs will be better able to integrate use
of the instrument into their ongoing administrative and clinical activities.
In addressing the use of OASIS for payment purposes, HCFA considers the
OASIS data elements to be crucial to refining payment rates, and if data
collection were limited to those elements currently needed for payment, its
ability to refine PPS in the future would be constrained. Regarding our
discussion of data confidentiality protections, HCFA highlighted several
specific steps it has taken to ensure patient privacy. HCFA's comments
appear in appendix IV. The agency made technical comments that we
incorporated where applicable.
We are sending copies of this report to the Honorable Robert A. Berenson,
Acting Deputy Administrator of HCFA, and others who are interested. We will
also make copies available to others on request. Rosamond Katz, Eric
Peterson, and Victoria M. Smith developed the information contained in this
report. Please contact me at (202) 512-7119 if you or your staffs have any
questions.
[0x08 graphic]
Janet Heinrich, Director, Health CarePublic Health IssuesList of Committees
The Honorable Arlen Specter, Chairman
The Honorable Tom Harkin, Ranking Member
Subcommittee on Labor, HHS, and Education
Committee on Appropriations
United States Senate
The Honorable Charles E. Grassley, Jr., Chairman
The Honorable Max Baucus, Ranking Member
Committee on Finance
United States Senate
The Honorable Ralph Regula, Chairman
The Honorable David R. Obey, Ranking Minority Member
Subcommittee on Labor, HHS, and Education
Committee on Appropriations
House of Representatives
The Honorable Nancy L. Johnson, Chairman
The Honorable Pete Stark, Ranking Minority Member
Subcommittee on Health
Committee on Ways and Means
House of Representatives
The Honorable William J. Tauzin, Chairman
The Honorable John Dingell, Ranking Minority Member
Committee on Commerce
House of Representatives
Appendix I: Methodology for Survey of Home Health Agencies
To gain the perspective of a representative segment of HHAs with respect to
the cost and privacy implications of the OASIS mandate, we surveyed a random
sample of HHAs. This appendix describes how the survey was conducted and
discusses the strengths and limitations of the information provided.
[0x08 graphic]
Survey Design
Determining how much it has cost HHAs to implement HCFA's mandate to collect
and report OASIS data on individual patients is complex, for three main
reasons. First, the OASIS mandate could lead to additional costs in many
different areas, including additional staff time to perform a variety of
tasks. HCFA required that the OASIS items be integrated with other
assessment forms, which could involve the development of both new forms and
new procedures to complete them. The process of encoding and transmitting
the OASIS data electronically led many HHAs to expand their use of
computers, which could have called in turn for capital investments and the
recruitment of new staff.
Second, the home health care industry was undergoing radical change. The
ongoing transition from cost-based reimbursement to prospective payment
fundamentally altered the financial circumstances and incentives of many
agencies. The characteristics of patients seeking and receiving home health
care may also have changed as a result. Staff recruitment, training,
computerization, and revamped procedures were all affected by these market
and payment-related changes as well, making it very difficult to isolate an
independent effect from the OASIS mandate.
Third, no cost data specifically linked to patient assessment activities
were systematically and consistently maintained either before or after the
implementation of the OASIS mandate. Instead, such activities are integrated
into the clinical and administrative functions of HHAs. Thus any attempt to
estimate the specific effect of OASIS on costs necessarily would involve
some reconstruction of such data after the fact.
Our survey of HHAs was designed with these factors in mind. Rather than
attempt to obtain a comprehensive accounting of all possible OASIS-related
costs, we focused on the additional time spent on four major activities that
appeared from our preliminary interviews with HHA officials to have had a
substantial effect on total costs:
* Clinicians' total time for the start-of-care visit,
* Supervisors' time reviewing and monitoring patient assessment data
collection,
* Time for training new hires on OASIS, and
* Time entering and transmitting OASIS data electronically.
We asked the executive directors of the HHAs we surveyed to provide both
current and pre-OASIS time figures from more than a year ago. It is common
for agencies to maintain logs with time spent at different types of visits.
While most HHAs said they were able to draw on relevant and specific
recorded data, others provided rough estimates. However variable in quality,
these data recorded by the HHAs for their own purposes represent the best
available data we found for estimating the cost implications of the OASIS
mandate.
[0x08 graphic]
Sample Selection
To select our sample, we used 1999 data extracted from HCFA's Provider of
Service File and associated claims data. We started with a list of each HHA
that had been paid for at least one Medicare home health visit in 1999. We
excluded those agencies that had not begun providing home care under
Medicare prior to January 1, 1999, and those that served fewer than 15
Medicare patients in 1999. We then selected a simple random sample from the
remaining agencies. Thus, the sample represents the universe of HHAs, not
patients.
Although our sample was not stratified, we did take precautions to ensure
that the agencies in the sample did not have a highly skewed distribution
along several major dimensions. Specifically, we observed the distribution
among all the HHAs in our sampling universe for five characteristicscaseload
size (number of Medicare patients treated annually), urban/rural, geographic
region, organizational affiliation (Visiting Nurse Association (VNA),
facility-based, freestanding), and tax status (nonprofit, for-profit,
government). (See table 1.) We then took a series of independent random
samples of 50 agencies each. (Every agency had an equal chance of being
selected for each of these samples.) We used the sample that best matched
the distribution found in the sampling universe.
Table 1: Percentage of All Agencies, Sample Agencies, and Survey Respondents
with Selected Characteristics
Universe (n =
6,772) Sample (n = 50) Respondents (n = 32)
Caseload size
Less than 100 28.9 30 25.0
100 to 249 28.6 30 37.5
250 to 999 32.6 30 28.1
1000 or more 9.9 10 9.4
Urban/rural
Urban 61.8 66 59.4
Rural 38.2 34 40.6
Region
Northeast 17.1 14 3.1
South 40.1 34 43.8
Midwest 26.6 30 21.9
West 16.2 22 31.3
Affiliation
Facility-based 34.6 38 43.8
Freestanding 59.3 54 50.0
VNA 6.1 8 6.3
Tax status
For-profit 47.2 46 43.8
Nonprofit 35.9 36 34.4
Government 16.9 18 21.9
Source: HCFA's 1999 Provider of Service file.
[0x08 graphic]
Sample Response Rate
We received usable responses from 32 HHAs. Three of the 50 surveyed had
ceased to operate as separate agencies, either by going out of business or
by merging with another entity. That gave us an effective response rate of
68 percent (32 out of 47). As shown above, the respondent group generally
matched the characteristics of the sampling universe and the sample. The
main exception was an underrepresentation of the Northeast region and
overrepresentation of the West. Facility-based agencies were also somewhat
overrepresented among the respondents compared to freestanding HHAs.
Because our sample was randomly selected, it provides unbiased estimates of
the results we would have received had we been able to survey the entire
universe. Still, a sample of 50 (with 32 respondents) is likely to have
considerable sampling error compared to that of a larger sample. The
standard errors and 95 percent confidence interval for the main survey items
presented in the report are provided below. These confidence intervals
indicate the range within which there is a 95 percent chance the mean would
fall if the full universe had been surveyed. They therefore show that there
is imprecision in the estimates of the means due to the relatively small
size of our sample. For example, the estimate for the mean time required for
start-of-care visits using OASIS was 143 minutes, but the 95-percent
confidence interval for that estimate ranged from 125 minutes to 160. In the
text of the report we chose to present medians rather than means, since they
are less sensitive to outliers. Table 2 below shows both means and medians.
Table 2: Medians, Means, and 95-Percent Confidence Intervals for Survey
Results
Variable Median Mean Standard 95% confidence interval
error
Start-of-care assessment
Clinician's time for
visit and
documentation 150.0 142.9 8.7 125.4-160.4
post-OASIS, minutes
Additional time using
OASIS, minutes 40.0 43.9 5.6 32.6-55.2
OASIS data review, entry and transmission
Supervisor's time
reviewing
start-of-care 30.0 31.8 3.2 25.3-38.2
assessment post-OASIS,
minutes
Additional time for
supervisory review of 15.0 16.0 2.8 10.5-21.6
OASIS data, minutes
Time to enter and
check OASIS data, 29.4 59.0 13.8 31.3-86.7
minutes per assessment 28.7a 40.4a 5.6a 29.4-51.6a
Time to transmit OASIS
data, minutes per 4.0 7.3 2.2 2.9-11.8
assessment 3.8b 5.4b 1.1b 3.2-7.6b
Staff training
Training new hires on
OASIS, hours 8.0 11.9 2.3 7.3-16.6
Additional new hire
training time 6.0 8.3 1.4 5.5-11.2
post-OASIS, hours
aRecalculated with two outliers removed.
bRecalculated with one outlier removed.
Source: GAO analysis.
Potential Measurement Error
Apart from the imprecision introduced by sampling considerations, numerous
factors are likely to have influenced the estimates provided to us by the
HHAs we surveyed:
* The surveyed HHAs varied in the extent to which they relied on written
records to calculate the amount of time taken for start-of-care visits
pre- and post-OASIS. We asked them to draw on such records if possible,
but available records varied from one agency to another.
* To the extent that the respondents believed that higher estimates of
time spent on post-OASIS visits might promote more generous payments
for home health care under Medicare, there could be an upward bias in
the figures provided.
* The comparison of current visit times with those preceding the OASIS
mandate incorporates the effects of all the changes that affected home
health care over that period, such as shifts in payment methods and
amounts by Medicare and other payers, fluctuations in market demand for
nursing and therapist staff, and the sharp decline in the number of
agencies providing care (following an earlier period of rapid growth),
as well as OASIS.
Appendix II: Development and Testing of the OASIS Data Set
OASIS was developed by the University of Colorado Center for Health Services
and Policy Research (CHSPR) for the purpose of measuring home health care
outcomes. This effort involved first a review of the existing approaches for
assessing the quality of home health care, including both a literature
review and consultations with clinical experts. A series of studies examined
the data that could be obtained from clinical records as well as secondary
data sources such as Medicare claims and plan-of-treatment forms. The
subsequent empirical testing of candidate measures collected data from 3,427
Medicare and non-Medicare patients treated in 49 HHAs.
The data elements collected were tested for their statistical reliability.
The measures based on those data elements were assessed on a range of
criteria, including their clinical meaningfulness (as judged by clinical
review panels), coverage across multiple dimensions of health status,
minimization of redundancy, and ability to detect differences among HHAs. At
the end of this process, CHSPR arrived at a set of 73 core data items needed
both to compute core quality indices and to adjust the outcomes reported for
different agencies to take account of relevant differences in the
circumstances of the patients that they treat (that is, risk adjustment).
In late 1994, HCFA convened a 13-member Standard Assessment work group made
up of HHA administrators, practicing clinicians, a clinical assessment
expert, a state official, and representatives of industry and professional
organizations. Its charge was to assess CHSPR's core data items for
inclusion in a patient assessment instrument to be mandated under revised
conditions of participation for HHAs under the Medicare program. This group
recommended that HCFA adopt the core data items with modifications.
Specifically, they suggested that HCFA expand three of the data elements,
convert one item to three more detailed items, and add eight new items,
including cognitive functions, financial ability to meet treatment needs,
and hearing, speech, and vision capabilities.
This expanded core data set, now named OASIS, was then tested in several
demonstration studies conducted by CHSPR. Beginning in 1995, a group of 50
HHAs nationwide, plus another 67 in New York State, were selected to see
whether HHAs could in fact use OASIS assessments to identify dimensions of
care with suboptimal outcomes and then take measures to improve those
outcomes. Empirical testing of the OASIS data and measures continued,
including a second round of reliability assessments. In addition, a
demonstration conducted by Abt Associates also collected OASIS data elements
for the purpose of identifying appropriate criteria for setting rates in a
home health PPS. A separate set of reliability assessments took place as
part of this study. The interim results published by Abt and CHSPR indicate
that the OASIS data set is generally reliable, although a few data items had
poor reliability according to the standards adopted in these studies. Both
CHSPR and Abt are planning to report additional reliability results based on
larger numbers of patients, but these findings are not yet available.
The Medicare Quality Assurance Demonstration and the New York State Outcome
Based Quality Improvement Demonstration showed that HHAs could use OASIS
data to improve home health care outcomes. Based on their initial OASIS
results, the HHAs examined their processes of care in order to develop plans
of action designed to enhance two specific outcomes: reducing the
hospitalization rate of their patients, and another outcome selected by each
participating HHA. Overall, the rate of hospitalization among patients
treated by the Medicare Quality Assurance Demonstration HHAs declined in one
year from 31.4 percent to 28.3 percent, a decrease of 10 percent. The
corresponding decline in hospitalization rates among patients in the New
York State Demonstration HHAs was 9 percent. However, no similar decrease in
hospitalizations was observed for home health patients nationally during
this period. Thus HCFA concluded that outcome-based quality improvement
initiatives adopted by the demonstration HHAs were effective in achieving
their stated objective.
Appendix III: OASIS Data Privacy Protections
Privacy Act Protections Applicable to OASIS
In protecting the confidentiality of health information of its
beneficiaries, HCFA's activities, like those of other federal agencies, are
governed by the Privacy Act of 1974 (5 U.S.C. 552a, P.L. 93-579). The
Privacy Act requires that agencies limit their maintenance of individually
identifiable records to those that are relevant and necessary to accomplish
an agency's purpose. Federal agencies store personally identifiable
information in systems of recordsa group of records, under the control of a
federal agency, from which information can be retrieved by the name of an
individual or an identifier such as a number assigned to the individual. As
of November 2000, HCFA had 47 systems of records related directly to
Medicare beneficiaries containing information stored in both electronic and
paper form. HCFA stores personally identifiable data on a Medicare
beneficiary's enrollment and entitlement to benefits; demographic
information such as age, race, ethnicity, and language preference; and
diagnoses and utilization of medical services.
The Privacy Act generally prohibits the disclosure of individuals' records
without their consent. However, it allows the disclosure of information
without an individual's consent under 12 circumstances called conditions of
disclosure, such as disclosure by a federal agency to its employees based on
their need for records to perform their duties. Another condition of
disclosure allows an agency to establish routine uses that the agency has
determined to be compatible with the purposes for which the information was
collected.
In accordance with the requirements of the Privacy Act, HCFA issued a notice
in June 1999 that it was establishing a new system of records to contain
OASIS data. In this notice, HCFA outlined several precautionary measures it
was taking to minimize risks of unauthorized disclosure. For example, HCFA
stated that it will collect only that information necessary to perform the
functions for which it plans to use the OASIS data, such as creating patient
outcome reports for HHAs. Similarly, HCFA said it will disclose only the
minimum amount of OASIS data necessary to achieve purposes compatible with
these functions. All patient-specific information is to be kept
confidential, with access limited to ensure that privacy remains protected.
Also included in the notice are the details regarding the scope of the data
collected and HCFA's policies and procedures regarding disclosures for the
following routine uses of OASIS data:
* Aid in the administration of the survey and certification of
Medicare/Medicaid HHAs,
* Enable regulators to provide HHAs with data for their internal quality
improvement activities,
* Support agencies of the state government to determine the overall
effectiveness and quality of HHA services provided in the state,
* Aid in the administration of federal and state HHA programs within the
state,
* Monitor the continuity of care for patients who reside temporarily
outside the state,
* Support regulatory, reimbursement, and policy functions,
* Support constituent requests made to a congressional representative,
* Support litigation involving the agency, and
* Support research projects related to disease prevention or health
maintenance.
In its notice, HCFA listed seven entities who may receive disclosures of
OASIS data under HCFA's routine use exception: (1) Department of Justice,
court or adjudicatory body, (2) agency contractors or consultants who have
been engaged by the agency to assist in the performance of a service related
to the OASIS system of records and who need to have access to the records in
order to perform the activity, (3) an agency of a state government, or
established by state law, (4) another federal or state agency (including
state survey agencies and state Medicaid agencies) for contributing to the
accuracy of HCFA's health insurance operations and/or for supporting state
agencies in the evaluations and monitoring of care provided by HHAs, (5) a
peer review organization, (6) an individual or organization for research
purposes, and (7) a member of Congress or congressional staff member in
response to an inquiry of the congressional office made at the written
request of the constituent about whom the record is maintained.
[0x08 graphic]
Other OASIS Data Privacy Protections
In addition to Privacy Act protections, beneficiaries are afforded
confidentiality protections under the HHA conditions of Medicare
participation. For example, HHAs and their agents cannot release OASIS
information that identifies particular patients to the public. Additionally,
patients have the following rights: (1) the right to know why the HHA is
asking the OASIS questions, (2) the right to have their personal health care
information kept confidential, (3) the right to refuse to answer questions,
(4) the right to look at, and request changes to, their personal
assessments, and (5) the right to be informed that OASIS information will
not be disclosed except for legitimate purposes allowed by the Privacy Act.
HCFA has established additional methods to ensure the security of OASIS
information while in transit and in storage. First, HCFA will retain
information on individuals who have non-Medicare/Medicaid payment sources in
a format that does not identify particular patients. For these patients, the
HHA will submit OASIS information with certain patient identifiers masked.
According to HCFA officials, masking involves obscuring items such as the
patient's name, Social Security number, and HHA patient identification
number, while still allowing data for individual patients to be linked.
These officials told us that they cannot decode masked identifiers or
re-identify the information based on nonmasked identifiers, and therefore
neither the state nor HCFA will know the identity of the
non-Medicare/Medicaid patients who are the subjects of transmitted OASIS
information.
Second, HHAs are currently required to submit OASIS data through a private
telephone line. HCFA officials told us that they required HHAs to transmit
OASIS data via the Medicare Data Communications Network (MDCN) as of October
1, 2000. The MDCN system includes an encryption standard for increased
protection from unauthorized access while the data are in transit. According
to HCFA officials, the MDCN's 128-bit encryption standard will guard against
unauthorized access to OASIS data, such as by computer hackers, while in
transit.
HCFA and state OASIS automation coordinators also told us that the use of
the MDCN network is subject to numerous password protections. In order to
access the MDCN, a user needs to know three different items of information,
all of which are subject to confidentiality policies: (1) the phone number
of the MDCN network, (2) the individual user identification number and
password for the MDCN, and (3) the HHA-specific user identification code and
password for the applicable state system. In addition, the MDCN passwords
must be changed on a periodic basis.
Third, according to HCFA officials, the agency has implemented physical
safeguards and record retention policies to reduce the risk of unauthorized
access over time. For instance, the HCFA OASIS data computer server is kept
in a secure room, and only personnel with designated access may enter. HCFA
officials told us that although they do not inspect the privacy safeguards
in place at the state level, guidelines issued to the state agencies require
server safeguards. The state OASIS coordinators we spoke with said their
server rooms are locked and access restricted. HCFA officials told us that
for now, OASIS data will not be maintained online for more than 3 years.
HCFA officials stated that they would also not maintain identifiable OASIS
data any longer than 15 years.
Appendix IV: Comments From HCFA
[0x08 graphic]
[0x08 graphic]
[0x08 graphic]
(201063)
Ordering Information
The first copy of each GAO report is free. Additional copies of reports are
$2 each. A check or money order should be made out to the Superintendent of
Documents. VISA and MasterCard credit cards are also accepted.
Orders for 100 or more copies to be mailed to a single address are
discounted 25 percent.
Orders by mail:
U.S. General Accounting Office
P.O. Box 37050
Washington, DC 20013
Orders by visiting:
Room 1100
700 4th St., NW (corner of 4th and G Sts. NW)
Washington, DC 20013
Orders by phone:
(202) 512-6000
fax: (202) 512-6061
TDD (202) 512-2537
Each day, GAO issues a list of newly available reports and testimony. To
receive facsimile copies of the daily list or any list from the past 30
days, please call (202) 512-6000 using a touchtone phone. A recorded menu
will provide information on how to obtain these lists.
Orders by Internet
For information on how to access GAO reports on the Internet, send an e-mail
message with info in the body to:
[email protected]
or visit GAO's World Wide Web home page at:
http://www.gao.gov
To Report Fraud, Waste, and Abuse in Federal Programs
[0x08 graphic]
Contact one:
* Web site: http://www.gao.gov/fraudnet/fraudnet.htm
* E-mail: [email protected]
* [0x08 graphic]
1-800-424-5454 (automated answering system)
Consolidated Appropriations Act for FY 2000, P.L. 106-113, app. F, title
III, section 301(b) (Nov. 29, 1999).
The services must be furnished under a plan of care established and
periodically reviewed by a physician.
P.L. 105-33, title IV, chapter I, 111 Stat. 251, 466. The Omnibus
Consolidated and Emergency Supplemental Appropriations Act of 1999, P.L.
105-277, delayed the implementation of the home health PPS until Oct. 1,
2000.
Payments also are adjusted if the episode of care is interrupted, such as
when a beneficiary elects to transfer to another HHA, when a beneficiary is
discharged because treatment goals are attained but then returns to the same
HHA, or when the beneficiary experiences a significant change in condition.
Episodes with extremely low service use (four or fewer visits) receive a
low-utilization payment adjustment based on per-visit costs.
These are the state agencies that HCFA contracts with to certify and approve
all HHAs that participate in the Medicare program as meeting certain federal
requirements and conditions of participation.
Medicare Home Health Agencies: Certification Process Ineffective in
Excluding Problem Agencies (GAO/HEHS-98-29, Dec. 16, 1997) and Medicare Home
Health Benefit: Congressional and HCFA Actions Begin to Address Chronic
Oversight Weaknesses (GAO/T-HEHS-98-117, Mar. 19, 1998).
As with other Medicare-certified providers, conditions of participation
apply to all patients they serve. Medicare-certified HHAs are required to
collect and report OASIS data for all patients regardless of payor source
unless they are (1) under the age of 18, (2) receiving maternity services,
(3) receiving housekeeping or chore services only, or (4) receiving personal
care services only.
Most OASIS data elements apply to each of these stages; others relate
specifically to one or two of these stages.
HHAs must collect OASIS data on both public and private pay patients because
section 1891(b) of the Social Security Act requires that the Secretary of
Health and Human Services ensure that the conditions of participation and
other requirements are adequate to protect all individuals under the care of
the HHA.
These are the state agencies designated by HCFA to receive the OASIS data
and maintain them in a database. The state OASIS contractor can be the same
as the state survey and certification agency.
State surveyors review the clinical and administrative records maintained by
the HHAs. They assess the services that the HHA has provided and cite
deficiencies in areas where the HHA has failed to comply with federal
regulations.
Risk-adjusted outcome reports take account of variations in the health
characteristics of the patients treated by different HHAs.
The peer review organizations in Maryland, Michigan, New York, Rhode Island,
and Virginia are participating in this project.
Medicare Payment Advisory Commission, Report to the Congress: Medicare
Payment Policy (Washington, D.C.: Medicare Payment Advisory Commission, Mar.
2000), p. 69. The Commission suggests that less subjective data would not be
as vulnerable to this type of manipulation but does not identify substitutes
for these OASIS data elements that would be at least as good in predicting
resource use and less susceptible to manipulation.
P.W. Shaughnessy, R.E. Schlenker, K.S. Crisler, and others, Measuring
Outcomes of Home Health Care, Vol. 1: Final Report, Study to Develop
Outcome-based Quality Measures for Home Health Services (Denver: Center for
Health Policy Research and Center for Health Services Research, University
of Colorado, 1994), pp. 6.31-6.42.
The elements it recommended adding to the core data set related to the
patient's physical environment, cognitive functions, financial ability to
meet treatment needs, and hearing, speech, and vision capabilities.
The other two items, currently being considered for use in adverse event
reporting, ask the reasons for patient hospitalization and services received
if the patient was discharged to the community.
Similarly, HCFA requires nursing homes to report outcome information on
private pay as well as Medicare and Medicaid patients.
The start-of-care visit time includes both time in the patient's home and
time spent completing required documentation outside the patient's home. In
addition to conducting the patient assessment, activities undertaken at
these visits include explanations of privacy rights as well as patient care.
Assessment-related activities outside the home include care planning and
coordination with other agency staff members. Subsequent assessments should
generally take less time, because the clinician already knows the patient
and many data items will remain unchanged.
We obtained the unpublished results of this analysis from CHSPR. To control
for other factors affecting the HHAs, CHSPR selected 10 of the 54
participating agencies that had implemented OASIS in one part of their
organization and not in others. CHSPR then surveyed 6 clinicians from each
of the 10 HHAs, half using OASIS and half not. Each respondent was asked how
much time she had spent in the patient's home and documenting the assessment
outside the home, for the start-of-care and at discharge, on average and for
the last such visit done. They were asked to recall the time spent, not
check logs.
The Abt study was designed to identify factors predicting resource use in
home health care. It therefore used a 129-item version of the OASIS data
set. The amount of time spent was measured in minutes at the time the visit
took place. We obtained unpublished data used in this study.
The survey was conducted 12 months after the OASIS mandate took effect. With
an adjusted sample size of 47 (3 of the original 50 HHAs in the sample were
no longer functioning as Medicare providers), 32 respondents represent a
response rate of 68 percent. The respondents generally matched the sample
and sampling universe, with the exception of underrepresenting the Northeast
region and overrepresenting the West, and to a lesser extent
overrepresenting facility-based agencies compared to freestanding ones. See
app. I for details.
Most of the surveyed HHAs said that they based their responses on visit logs
and similar records, while others provided estimates.
Medicare Home Health Care: Prospective Payment System Could Reverse Recent
Declines in Spending (GAO/HEHS-00-176, Sept. 8, 2000), p. 24.
HAVEN stands for Home Assessment Validation Entry. To provide other options
for HHAs that prefer not to use HAVEN, HCFA has assisted private sector
vendors of data processing services in making their systems compatible with
OASIS requirements.
HHA officials we interviewed told us that patient complaints regarding the
privacy of their OASIS information are rare.
We have not reviewed the implementation of the system, and without testing
the security mechanisms in place at HCFA, state agencies, and HHAs, we
cannot be assured the steps taken will adequately protect the privacy of
non-Medicare/Medicaid patients.
HCFA officials told us they expect to require the transmission of OASIS data
on non-Medicare/Medicaid patients in the spring of 2001.
In protecting the confidentiality of health information of its
beneficiaries, HCFA's activities, like those of other federal agencies, are
governed by the Privacy Act of 1974. A more detailed discussion of the
Privacy Act and HCFA's Notice of the OASIS System of Records is also
contained in app. III.
In accordance with Privacy Act requirements, HCFA published its routine uses
for OASIS information in the Federal Register. These uses are listed in app.
III.
Medicare: Improvements Needed to Enhance Protection of Confidential Health
Information (GAO/HEHS-99-140, July 1999).
Guidelines issued to the state agencies by HCFA recommend specific
safeguards, such as a policy that defines and limits the qualifications for
an individual to access the OASIS system. These safeguards generally follow
the guidance found in Office of Management and Budget Circular A-130
(revised), Appendix III, Security of Federal Automated Information
Resources.
In its Notice of the OASIS System of Records, HCFA does not mention having a
system to routinely monitor third-party compliance.
Since the mid-1980s, CHSPR has conducted a series of studies examining
quality of care in home health services. The center received funding from
both HCFA and the Robert Wood Johnson Foundation specifically to develop and
test outcome-based indicators of quality in home health care.
P.W. Shaughnessy, R.E. Schlenker, K.S. Crisler, and others, Measuring
Outcomes of Home Health Care, Vol. 1: Final Report, Study to Develop
Outcome-based Quality Measures for Home Health Services (Denver: Center for
Health Policy Research and Center for Health Services Research, University
of Colorado, 1994), pp. 6.31-6.42.
In 1996, HCFA funded a major study by Abt Associates to develop a case-mix
adjustment method to be used in the home health PPS.
The kappa statistic is generally accepted as the appropriate statistical
measure of reliability. The independent assessment of OASIS reliability
conducted by Abt Associates interpreted a kappa of .40 or below as
indicating poor, .41 to .74 as moderate, and .75 or above as excellent
reliability. See H.B. Goldberg, Case-Mix Adjustment for a National Home
Health Prospective Payment System, Contract No. 500-96-0003/TO#2, Second
Interim Report (Cambridge, Mass.: Abt Associates Inc.), Sept. 24, 1999, p.
G-9. The CHSPR group did not specify comparable thresholds, but cited
several individual data elements with kappas ranging from .25 to .45 as
having relatively low values, which suggested that they should be revised or
replaced (Shaughnessy and others, Outcome-based Quality Measures, p. 5.6).
While the Privacy Act permits agencies to disclose information, it does not
require that they do so. Agencies can, for example, determine that in a
particular case the privacy interest outweighs the public interest in a
disclosure. However, an agency generally must disclose information
maintained about an individual to that individual at his or her request.
64 Fed. Reg. 32992 (June 18, 1999). On the same day, HCFA also issued a
notice requiring OASIS data collection and transmission. See 64 Fed. Reg.
32984 (June 18, 1999).
With respect to authorized users, HCFA's safeguards include (1) training
them in the Privacy Act and systems security requirements, (2) prohibiting
them from releasing information until they have the agreement of the
recipient that appropriate administrative, technical, procedural, and
physical safeguards have been (or will be) implemented, (3) monitoring them
to ensure against excessive or unauthorized use, (4) requiring them to use
records in a designated work area or work station, and (5) assigning them an
appropriate database user class that restricts access accordingly.
For purposes of determining, evaluating, and/or assessing overall or
aggregate cost, effectiveness, and/or the quality of HHA services provided
in the state; for developing and operating Medicaid reimbursement systems;
or for administration of federal/state HHA programs within the state.
The regulation on state agency OASIS collection and database
responsibilities requires the state agency to ensure that access to OASIS
data is restricted and that OASIS data are released only to the extent
permitted under the Privacy Act.
*** End of document. ***