(a) Data privacy compliance. The RO participant must—

(1) Comply with all applicable laws pertaining to any patient-identifiable data requested from CMS under the terms of the Innovation Center model, including any patient-identifiable derivative data, as well as the terms of any attestation or agreement entered into by the RO participant with CMS as a condition of receiving that data. Such laws may include, without limitation, the privacy and security rules promulgated under the Health Insurance Portability and Accountability Act of 1996 (HIPAA), as modified, and the Health Information Technology for Economic and Clinical Health Act (HITECH).

(2) Contractually bind all downstream recipients of CMS data to the same terms and conditions to which the RO participant was itself bound in its agreements with CMS as a condition of the downstream recipient's receipt of the data from the RO participant.

(b) RO participant public release of patient de-identified information. The RO participant must include the disclaimer codified at § 512.120(c)(2) on the first page of any publicly-released document, the contents of which materially and substantially references or is materially and substantially based upon the RO participant's participation in the RO Model, including but not limited to press releases, journal articles, research articles, descriptive articles, external reports, and statistical/analytical materials.

(c) Reporting quality measures and clinical data elements. In addition to reporting described in other provisions in this part, Professional participants and Dual participants must report selected quality measures on all patients and clinical data elements describing cancer stage, disease characteristics, treatment intent, and specific treatment plan information on beneficiaries treated for specified cancer types, in the form, manner, and at a time specified by CMS.

(d) Technical participants and reporting of quality measures and clinical data elements. Technical participants that are freestanding radiation therapy centers and also begin furnishing the professional component during the model performance period must:

(1) Notify CMS no later than 30 days after the technical participant begins furnishing the professional component, in a form and manner specified by CMS; and

(2) Report quality measures and clinical data elements by the next submission period, as described in paragraph (c) of this section.