100-10 Quality Improvement Organization Manual: Chapter 8 - Infrastructure Operations Support and Data Management

Quality Improvement Organization Manual
Chapter 8 – Infrastructure Operations Support and
Data Management
Table of Contents
(Rev. 22, 12-02-15)
Transmittals for Chapter 8
8000 - Introduction
8005 – Infrastructure Operations and Support Manual
8010 – Infrastructure Information Technology Administrator Manual
8015 – Database Systems Administrator Guide
8020 – Security Handbook
8025 – System for Confidentiality of QIO Program Data
8030 – IT Performance Standards

8000 – Introduction
(Rev. 22, Issued: 12-02-15, Effective: 12-02-15, Implementation: 12-02-15)
This chapter describes the minimum requirements and responsibilities of the Quality
Improvement Organizations (QIOs) in using information technology (IT) infrastructure
and managing electronic data for the QIO Program. QIOs must use the applications,
tools, and systems furnished by CMS that are accessible through a secure Intranet site.
This chapter describes the supporting documents that govern the policies and procedures
for the CMS-furnished secure network environment that are the basis of the IT
performance standards on which the QIO will be reviewed. The QIOs must meet or
exceed all IT performance standards listed in Section 8030 IT Performance Standards.
CMS furnishes the IT manuals described in this chapter to QIOs and other authorized
CMS contractors that support the QIO Program. CMS routinely updates and revises the
documents as changes in the IT environment and program operations occur.
8005 – Infrastructure Operations and Support Manua l
(Rev. 22, Issued: 12-02-15, Effective: 12-02-15, Implementation: 12-02-15)
The Infrastructure Operations and Support Manual provides policy and procedure
information to the QIO user community regarding IT infrastructure. This manual
delineates roles and responsibilities for QIO users, administrators, CMS personnel, and
CMS contractor personnel working within the QIO IT infrastructure environment. The
expectation is that the community will use the manual as a reference for questions
regarding IT policy issues and practices. This manual will also assist QIOs, Help Desk
personnel, CMS, and CMS supporting contractors in interacting and communicating in
order to support the IT infrastructure. The manual is available through the CMS-
furnished secure Intranet site (secure log in is required).
8010 – Infrastructure Information Technology Administrator Manual
(Rev. 22, Issued: 12-02-15, Effective: 12-02-15, Implementation: 12-02-15)
The Infrastructure Information Technology Administrator Manual is a companion
document to the Infrastructure Operations and Support Manual discussed in Section
8005. This manual gives a general description of the work environment for QIO network
administrators, as well as specific detailed procedures that network administrators need
to perform. The manual is available through the CMS-furnished secure Intranet site
(secure log in is required).
8015 – Database Systems Administrator Guide
(Rev. 22, Issued: 12-02-15, Effective: 12-02-15, Implementation: 12-02-15)
The Database Systems Administrator Guide provides QIO database administrators with
instructions, guidelines, and samples needed to perform the basic day-to-day operations
on QIO databases. Users may reproduce this document as necessary. The guide is
available through the CMS-furnished secure Intranet site (secure log in is required).

8020 – Security Handbook
(Rev. 22, Issued: 12-02-15, Effective: 12-02-15, Implementation: 12-02-15)
The System Security Policy establishes a security management process for QIO users
that complies with the Computer Security Act of 1987 (P.L. 100-235), the Health
Insurance Portability and Accountability Act of 1996 (P.L. 104-191), Appendix III to the
Office of Management and Budget (OMB), Circular No. A-130 (50 FR 52730; December
24, 1985), Federal Information Security Management Act (FISMA), Title III of the E-
Government Act of 2002 (Public Law 107-347, 44 U.S.C. Chapter 36), the Department of
Health and Human Services and CMS information security policy, programmatic
direction, standards, guidelines, and handbooks. Use of the CMS-furnished IT
infrastructure environment as well as access to and use of QIO Program data is subject
to CMS information security and privacy policy and program oversight provided by the
CMS Office of the Chief Information Office and the Chief Information Security Officer.
All personnel working within the CMS-furnished IT infrastructure and data environment
must abide by the policies and procedures set forth in the Security Policy, read the
Statement of Acceptance, and sign the Policy Acceptance Log attesting to the acceptance
of these policies once a year.
The Security Policy provides guidelines pertaining to the appropriate use of the Internet
and email resources for transmission of QIO Program data. The System Security Policy is
available for download on the main page of the QIO Program Internet site (secure log in
is not required).
8025 – System for Confidentiality of QIO Program Data
(Rev. 22, Issued: 12-02-15, Effective: 12-02-15, Implementation: 12-02-15)
QIOs are required to protect the confidentiality of data in accordance with section 1160
of the Social Security Act (42 USC 1320c-9) and regulations at 42 CFR 480. Chapter10
of the QIO Manual provides guidance on requirements for protecting the confidentiality
of QIO Program data. The transmission and storage of such data must be consistent and
compliant with the requirements to protect the data. CMS provides a secure file
exchange application to safeguard the electronic transmission or exchange of sensitive or
confidential data, including but not limited to data containing personally identifiable
information (PII) and protected health information (PHI). The purpose of the secure file
exchange application is to provide increased efficiencies in information exchange and to
support secure communication and healthcare quality data between two or more
organizations, including: hospitals, physician’s offices, nursing homes, QIOs, End-Stage
Renal Disease (ESRD) facilities, ESRD Networks, performance measurement systems,
data vendors, and the Clinical Data Abstraction Center (CDAC). The secure file
exchange application that is available through the secure Intranet site is the CMS
approved method to exchange files containing PII or PHI data, and to protect other
confidential information. Information retrieved and/or transmitted within this system is
protected from external access.

In addition, users shall not connect or install external systems, applications, or devices to
the secure IT environment without prior approval from CMS. CMS approval may be
granted through the Engineering Review Board (ERB) request process. Failure to obtain
CMS approval for connections to external IT systems, applications, or devices may result
in disconnection from the secure IT infrastructure environment without warning.
8030 – IT Performance Standards
(Rev. 22, Issued: 12-02-15, Effective: 12-02-15, Implementation: 12-02-15)
The QIO Program IT performance standards are based on five system administrative
performance areas that must be met or exceeded during the course of the contract.
The performance standards areas are as follows:
• 	Contingency Planning – This category concerns preparation for disaster or the
loss of information. It includes contingency planning, archiving, backup, and
storage operations to restore operability of IT system resources and QIO Program
information
• 	System Maintenance – This category concerns maintenance of IT system
resources. It includes proper monthly maintenance and application of routine and
emergency updates, upgrades, and patches in compliance with CMS hardware,
software, security standards, and operational practices
• 	User and Administrator Training – This category concerns user and system
administrator compliance with training on contractor and CMS-furnished IT
systems, networks, applications, devices, standards, procedures, and security
• 	Security – This category concerns safeguards for the security of QIO Program
information collection, storage, use, sharing, retention, and destruction, security
for IT access controls and operational practices, and the protection of privacy
data and confidential information
• 	Inventory – This category concerns maintenance of inventories for contract
acquired and CMS-furnished property

Transmittals Issued for this Chapter
Rev # 	Issue Date 	Subject 	Impl Date CR#
R22QIO 	12/02/2015 	QIO Manual Chapter 8 – “Infrastructure
Operations Support and Data Management”
12/02/2015 N/A
R14QIO 	04/07/2006 	Revisions to Chapter 8, "Data Management"
for consistency with 8th Statement of Work
contract cycle
04/07/2006 N/A
R1QIO 	05/23/2003 	Initial Issuance of Chapters 2, 8, 13 and 15 	N/A 	N/A
Back to top of chapter