CMS Pub. 100-18, ch. 14, § 50.13

Consistent with the HIPAA Privacy Rule (45 CFR Part 160 and Subparts A and E of Part

164), the CMS Part D Transaction Facilitator will be a business associate of Part D sponsors

for the purpose of performing TrOOP facilitation and COB functions when it receives data

directly from the sponsor. Currently, the facilitator receives data from a sponsor whenever a

beneficiary makes a contract-level enrollment change during the coverage year, and the

automated TrOOP balance transfer process is triggered. In that process, the Transaction

Facilitator receives data from the disenrolling Part D plan as well as from any prior Part D

plan in which the beneficiary was enrolled during that coverage year. Note that the BAA

requirement is applicable not only to sponsors directly reporting the TrOOP accumulators to

the CMS Part D Transaction Facilitator , but also to sponsors using a processor for the

automated TrOOP balance transfer process. Therefore, each Part D sponsor must execute

and submit the CMS-approved D Transaction Facilitator BAA to the CMS Part D

Transaction Facilitator.

45

On January 25, 2013, the Office for Civil Rights (OCR) issued an omnibus fi nal rule (78 FR

5566) that modified the HIPAA Privacy, Security, and Enforcement Rules to implement the

new statutory requirements included in the Health Information Technology for Economic

and Clinical Health Act (HITECH). Among the Privacy Rule changes addressed in the final

rule was the extension of certain HIPAA requirements to business associates. As a result,

the former standard language CMS Part D Transaction Facilitator BAA was revised to

incorporate these changes.

The revised BAA, and implementation form and instructions for the completion and

submission of the documents are available on the Facilitator’s Website. (See Appendix B for

the specific web address.) CMS strongly encourages Part D sponsors to execute the CMS

Part D Transaction Facilitator BAA without modification. Only those modifications

required by state regulations will be permitted.

Note that while PACE plans are not required to participated in the Automated TrOOP

Balance Transfer process, they are required to coordinate be nefits and receive data from

accept Nx transactions. As such all PACE programs are required to have an executed CMS

Part D Transaction Facilitator BAA.