Quality Assurance Guidelines CAHPS® Hospital Survey - HCAHPS

March 2011
Survey Management
receipt and handling of returned surveys, through data entry, validation and edit
checking) on an ongoing basis, and verify that staff and subcontractors are compliant
with HIPAA regulations
‣ provide feedback on performance of all staff and subcontractors, through regular
assessments, with special emphasis placed on detection and correction of identified
performance problems
The HCAHPS Project Team will conduct on-site visits to hospitals/survey vendors to review
hospitals’/survey vendors’ operations, monitoring and quality oversight practices. As noted
earlier, if a survey vendor is non-compliant with program requirements for any of their
contracted hospitals, the hospital’s data may not be publicly reported.
Safeguarding Patient Confidentiality
Hospitals/Survey vendors must take the following actions to further protect the confidentiality of
patients:
‣ Prevent unauthorized access to confidential electronic and hard copy information by
restricting physical access to confidential data (use locks or password-protected entry
systems on rooms, file cabinets and areas where confidential data are stored)
‣ Develop HCAHPS or survey specific confidentiality agreements and obtain signatures
from all personnel with access to survey information, including staff and all
subcontractors involved in survey data collection
‣ Confirm that staff and subcontractors are compliant with HIPAA regulations in regards to
protected health information (PHI)
‣ Establish protocols for secure file transmission. Emailing of PHI via unsecure email is
prohibited.
‣ Establish protocols for identifying security breaches and instituting corrective actions
‣ Establish protocols for identifying patients who are excluded from the HCAHPS survey.
For a list of exclusions, please refer to the Sampling Protocol section of this Quality
Assurance Guidelines V6.0 manual. Excluded patients are removed from the eligible
patient list by the hospital/survey vendor before the HCAHPS sample is drawn. Patients
found to be ineligible after sampling must not be replaced in the sample.
‣ Store returned mail questionnaires in a secure and environmentally safe location
Note: It is strongly recommended that the method used by contracted hospitals to transmit
information (e.g., patient discharge files, etc.) to the hospital/survey vendor be reviewed by the
hospitals’ HIPAA/privacy officer to confirm compliance with HIPAA regulations. Any materials
(e.g., QAP, questionnaires, cover letters, tracking forms, etc.) submitted by the hospital/survey
vendor to the HCAHPS Project Team must be blank templates and must not contain any patient
PHI.
Data Security
Hospitals/Survey vendors must securely store patient identifying electronic data and responses to
the survey. Hospitals/Survey vendors must take the following actions to secure the data:
‣ Use a firewall and/or other mechanisms for preventing unauthorized access to the
electronic files
Centers for Medicare & Medicaid Services 37
HCAHPS Quality Assurance Guidelines V6.0