drg_registration_form 20140826 shortened

38
Data Release Governance Program, Process, SharePoint Registration Site and Form 7/28/2014

Upload: debra-elliott

Post on 17-Aug-2015

19 views

Category:

Documents


0 download

TRANSCRIPT

Data Release Governance

Program, Process, SharePoint Registration Site and Form

7/28/2014

Guide for Requesters

Table of Contents

Introduction....................................................................................................................................... 5

Why Do We Need DRG?.............................................................................................................5

Data Release Governance Program............................................................................................6

Data Release Governance Process.............................................................................................3

Data Release Governance Process Diagram...............................................................................3

Getting Started.................................................................................................................................. 3

Data Release Business Process Documentation.........................................................................3

Vendors........................................................................................................................................ 3

Prerequisites..................................................................................................................................... 4

Coursework.................................................................................................................................. 4

Applying in Secure....................................................................................................................... 4

Navigating to the DRG Registration Form....................................................................................5

Working with the Registration Form.............................................................................................9

Form Completion—Part 1: General...................................................................................................12

Load............................................................................................................................................. 13

A................................................................................................................................................... 13

Contact Information...................................................................................................................... 14

Requesting Source....................................................................................................................... 14

Registration Details...................................................................................................................... 15

Business Process-specific Fields.................................................................................................16

General Registration Details........................................................................................................19

Data Source................................................................................................................................. 22

Process Controls.......................................................................................................................... 29

Form Completion—Part 2: External Entities......................................................................................33

Vendor......................................................................................................................................... 34

Target Audience........................................................................................................................... 42

Business Segment....................................................................................................................... 48

Form Completion—Part 3: Submit....................................................................................................52

Risk Identification......................................................................................................................... 52

Other Registration Functions............................................................................................................56

Approving a Registered Release..................................................................................................56

Finding a Request........................................................................................................................ 57

Finding (via Report) and Reviewing a Registration......................................................................58

Putting a Registration on Hold......................................................................................................59

Recertifying a Data Release.........................................................................................................60

Retiring a Registration.................................................................................................................. 63

Sending a Message.....................................................................................................................65

Verifying an Ad Hoc Release.......................................................................................................66

© Copyright 2014, UnitedHealth Group. All Rights Reserved. 3

DRG Registration Guide

Withdrawing a Registration..........................................................................................................68

Appendices....................................................................................................................................... 69

Appendix X: Policy 13..................................................................................................................70

Appendix X: Role Checklists........................................................................................................71

Appendix X: Business Process Documentation Template, Directions, and Sample....................75

Appendix X: Adding or Removing a Vendor.................................................................................87

Appendix X: DRG Registration of Non-integrated UnitedHealth Group Entities (M&As) Releasing Protected Information...................................................................................................................91

Appendix X: Reporting.................................................................................................................92

Appendix X: Glossary...................................................................................................................93

© Copyright 2014, UnitedHealth Group. All Rights Reserved. 4

DRG Registration Guide

IntroductionThe purpose of this guide is to provide users of the Data Release Governance (DRG) with knowledge of:

The DRG program

The DRG process including required roles

Detailed tasks by role

The SharePoint DRG Registration site

The DRG Registration Form

A field-by-field description of the data that needs to be entered into the three-part form

Common online tasks around the registration after it is submitted

Several appendices contain additional information.

Why Do We Need DRG?

UnitedHealth Group’s constituents rely on us to protect members’ private information, and laws require this of us as well. Our company has put in place Information Security Policy 13 (see Appendix X for a link to the policy) to provide guidance for employees around this crucial responsibility. The Data Release Governance program comes from Policy 13.

We need data release governance because:

It’s About Trust. In serving our customers, we send out millions of mailings and files with protected or confidential customer data each year. Our customers and stockholders expect and deserve 100% accuracy and quality in support of our trusted relationship. The current transmission or mailing of customer or member data is a complex process with lots of variability. When not the process is improperly followed, this could result in protected or confidential information being improperly dispersed.

It’s About Vigilance. While the most pressing reason for this urgency is our desire to retain the hard-earned confidence of those we serve, there are other reasons:

o Recent legislation increases the risk of monetary penalties of up to $1.5 million for any disclosure that improperly includes protected or confidential customer information.

o Such a mishap may also require us to identify the breach on a national website and notify the media, tarnishing our market reputation.

o Continued vigilance and building trust are key components to our future, the retention of customers, and growth of new business.

It’s About Protection. The Data Release Governance Program supports our goal for a vigilant culture. The program’s purpose to eliminate or reduce and mitigate the risk and exposure of data breaches. Eliminating or reducing risk will enhance the protection of information we own or maintain through the implementation of an enterprise-wide process.

The next several pages explain the DRG program and process.

© Copyright 2014, UnitedHealth Group. All Rights Reserved. 5

DRG Registration Guide

Data Release Governance Program

The DRG program is designed to reduce the risk of data exposure or data breaches as information is sent outside UnitedHealth Group. The program also aims to limit the amount of information released (specifically Protected Health Information) to the minimum required to meet business needs.

As part of the program, a process and tool have been created to register Protected Information sent outside of the organization. Registration for a recurring release of data requires that quality and security measures be documented and utilized within a business group and segment. Such measures are intended to ensure that Protected Information stays protected before, during, and after it is released.

Data protection includes close examination of business processes that send individual member data outside of UnitedHealth Group. Examples include EOBs or credit card statements. Refer to the Data Elements Chart to determine if the data you are sending outside of UnitedHealth Group meets the criteria requiring registration.

Registrations for data releases come in two major types: Ad Hoc (one time) or Business Process (recurring).

Ad Hoc is a one-time method of creating and delivering information. Such data goes to an external entity for a specific business reason using an approved delivery method. An Ad Hoc registration does not require a documented business process.

Each Business Process registration requires a documented functional and repeatable business segment or group process. The documented process shows how Protected Information is processed and securely delivered to a specific vendor(s) or target audience(s) to fulfill a business need. Such a release is either regularly scheduled or released on-demand.

Reasons for Registration

Registering Protected Information for a data release must occur when:

Releasing data to an external entity, such as a:

o Customer

o Employer

o Member

o Provider

o Regulatory Body

o Vendor

Releasing data internally to:

o UnitedHealth Group business segments

o Mergers & Acquisitions (acquired entities)

Registering an Ad Hoc (one time) or Business Process release that matches data types in the Data Elements Chart

© Copyright 2014, UnitedHealth Group. All Rights Reserved. 6

Guide for Requesters

Data Release Governance Process

The DRG process is designed to prevent Protected Information from being exposed or misused in any way. If there is potential for this, a release may be deemed high risk.

A high risk release has the potential for data exposure or a data breach if sent outside the organization. This could compromise the Protected Information of UnitedHealth Group’s members.

A diagram showing the DRG process appears later in this document. Become familiar with the process and the roles within the DRG process.

DRG Roles

The DRG process calls for several different roles (see the Prerequisites section for certification requirements for the first four roles):

Submitter: An individual authorized by the business group to submit DRG registrations on behalf of someone within the group. The Submitter is responsible for working with the person requesting the release to collect appropriate information and complete registration tasks.

Approver: An individual authorized by the business group to ensure the DRG registration is business-appropriate and meets applicable legal, regulatory, and business requirements before approving the release of data to an external party. In the event of uncertainty, the Approver should contact their segment or UnitedHealth Group Privacy Office for guidance.

Information Owner: An individual authorized by the business group to review the data produced for the release for quality and integrity and to verify that it meets necessary requirements.

Reviewer: An individual authorized by the business group to ensure the DRG registration meets minimum necessary requirements, applicable legal, regulatory, and business requirements as well as applicable Privacy and Information Security policies. In the event of uncertainty, the Reviewer should contact their segment or UnitedHealth Group Privacy Office for assistance.

Extract Team: The team responsible for developing the extract of data in whatever form it is being requested.

Distributor: An internal UHG group or individual through which information is sent to an external entity.

Requesting Source: The individual from a Business Group who has identified a business need for releasing information (mailing, welcome kit, etc.) to a recipient.

To familiarize yourself with duties required by the DRG process, review the checklist associated with the role you will fill. Each role’s checklist first defines the role and then lays out required tasks. See Appendix for role checklists.

© Copyright 2014, UnitedHealth Group. All Rights Reserved. 3

DRG Registration Guide

The DRG Process

The DRG process works like this:

1. The Requesting Source communicates to a Certified Submitter the need to release Protected Information outside their group.

2. The Submitter creates and submits a registration for the data release.

a. If the data release is supposed to go to a vendor, the vendor must be on the UnitedHealth Group’s approved DRG Vendor List.

i. If it is not on the list, the vendor must complete the SAR process/security review.

ii. If the vendor passes the review, the Submitter may proceed with the registration.

iii. If the vendor does not pass the security review, data cannot be released.

b. If it is a one-time request (Ad Hoc), a data extract is created, based on business requirements. At this point, the Submitter sends a request for verification to the Information Owner and Certified Reviewer who determine whether the release is high risk.

c. If it is a Business Process registration, it goes directly to the Approver.

3. A Certified Approver performs a comprehensive analysis of the registration.

a. If the registration is for a vendor and the vendor is already approved and on the list, the Approver then validates the business need. They also inspect and follow up on the attached business process. They do this to ensure the data is the minimum required, accurate, will be delivered safely, and follows regulations.

b. If the registration is for a Business Process release, the Approver receives a verification form and scrutinizes the registration’s potential as a high-risk release.

4. If it is a high-risk release, the Approver contacts the business segment’s Certified Information Owner and Certified Reviewer for a compliance review.

5. The Information Owner and Reviewer discuss the registration request.

a. The Reviewer assesses the request to ensure that the high-risk release serves a valid business need and that the release meets policy and compliance requirements.

b. The Information Owner then checks to see that the registration meets business requirements.

c. If the registration complies with both requirements, it can be approved.

d. If it does not meet one or both requirements, the registration must be rejected.

6. The Information Owner and Reviewer communicate their decision to the Approver.

7. For an Ad Hoc request, the Approver ensures that data verification is performed and submits a Verification Form.

8. The Approver either approves or rejects the registration.

a. If the request does not meet valid a business need or requirements, the Approver rejects the registration.

© Copyright 2014, UnitedHealth Group. All Rights Reserved. 4

DRG Registration Guide

b. If they find that a registration is not high risk, or the Information Owner and Reviewer have reviewed and support the registration, and it meets a valid business need, the Approver approves the registration.

9. The Submitter facilitates the execution of approved data releases:

a. First, the Submitter confirms with the Requesting Source that the release should be released as registered.

b. For Business Process registrations, a Distributor releases the data to the third party: a vendor, a target audience or another business segment within UnitedHealth Group.

c. For Ad Hoc registrations, an Extract Team uses an existing fulfillment request process to produce and release the data.

The next page shows a diagram of this process.

© Copyright 2014, UnitedHealth Group. All Rights Reserved. 5

Guide for Requesters

Data Release Governance Process Diagram

Placeholder for Updated Swimlane Diagram

© Copyright 2014, UnitedHealth Group. All Rights Reserved. 3

Guide

Getting StartedLike any business effort around a release of critical, sensitive information, your business segment/group must perform due diligence before any data can be released.

Before considering a data release, ensure that these two essential tasks are completed:

A repeatable business process for recurring data releases is fully documented

All vendors to receive data are on the approved DRG Vendor List

Data Release Business Process Documentation

Before your organization may release data, it must provide proof that its process ensures the data’s safety, quality, and accuracy. Such proof means that documents must be available showing the steps taken to protect and verify quality and protection of the data released.

A detailed explanation of requirements and expectations around a fully documented and repeatable business process is in Appendix. Materials in that appendix include a business process documentation template, directions, and a sample.

Prior to registering for a data release, the following must be documented:

1. Business process

2. Training records or description

3. Business risk evaluations

4. Quality reviews

Vendors

Any vendor intended to receive a UnitedHealth Group data release must have completed a risk assessment and been added to the approved DRG Vendor list.

If a vendor has not completed a risk assessment, its name will not be available within the DRG Registration Form for selection.

To see if a vendor is approved, check the Vendor List on your intranet’s DRG Home page.

See Appendix for complete instructions for adding a vendor.

© Copyright 2014, UnitedHealth Group. All Rights Reserved. 3

DRG Registration Guide

PrerequisitesWhile the Getting Started tasks are being completed (if not already), you can complete two required role-oriented tasks:

Become certified for a role: Before you can assume DRG registration duties, you must complete two tasks.

Obtain role-holder security; you must have proper security access to get into the DRG tool (dashboard and registration form).

Coursework

To qualify for a role, you must first:

1. Complete the two CBTs, Data Release Governance Overview and Data Release Governance Roles and Responsibilities, found on LearnSource.

2. Pass the test that accompanies the CBTs.

Applying in Secure

You must have role-holder security assigned to access the DRG tool.

To request DRG role-holder security:

1. Access the Secure website at https://secure.uhc.com/.

2. From the left navigation pane under My Access, select Request New Access and complete the form.

You may also change or remove DRG role-holder access in Secure.

© Copyright 2014, UnitedHealth Group. All Rights Reserved. 4

DRG Registration Guide

Navigating to the DRG Registration Form

After completing business process documentation, adding needed vendors, getting certified and security access, you are ready to complete your first registration.

To do so, you must know how to:

1. Navigate to the DRG Home page.

2. Access the SharePoint DRG Registration site.

Navigating to the DRG Home Page

The SharePoint DRG Registration site is where to view and work with DRG registrations and perform duties assigned to your role.

To navigate to the SharePoint DRG Registration site:

1. Go to Frontier or any UnitedHealth Group Intranet Home page.

2. On the right side of the page under Important Links > Resources & Support, find and select the link, Data Release Governance (DRG). The DRG Home page is displayed.

3. Click the Data Release Registration Form link. The SharePoint DRG Registration site is displayed.

© Copyright 2014, UnitedHealth Group. All Rights Reserved. 5

DRG Registration Guide

Working in the SharePoint DRG Registration Site

The SharePoint DRG Registration site contains three important sections:

Home tab

Left navigation pane

DRG dashboard, which shows registrations that you have either created or require your attention, depending on your role.

Home tab: Click this tab to return to the dashboard from anywhere within the site. It is available on every view and form within the site.

Left navigation pane: The left navigation pane also stays in place regardless of the form or view displaying within the SharePoint site. It contains several links to views and forms.

Pages

© Copyright 2014, UnitedHealth Group. All Rights Reserved. 6

Dashboard

Left navigation pane

Home tab

DRG Registration Guide

The Pages area offers a variety of links to forms and views.

The New Registration link opens a new, unpopulated DRG Registration Form.

The Request Search link is displayed in a new page with a search field and buttons.

The Dashboard link is re-displayed the SharePoint Home page from anywhere within the site.

Clicking the Recycle Bin link allows you to view any discarded registrations.

© Copyright 2014, UnitedHealth Group. All Rights Reserved. 7

DRG Registration Guide

Dashboard

This section of the DRG SharePoint site allows you to work with registrations as defined by your role.

It contains the following sections:

My Draft Registrations: View registrations that are not yet submitted

Draft Registrations for which I am the Backup Submitter: View registrations for which you have been named Backup Submitter

My Submitted Registrations: View or withdraw registrations that you have submitted

Review Registrations: Shows the queue of Business Process registrations awaiting your review for approval or rejection

Ad Hoc Registrations: Shows the list of Ad Hoc registrations for your review and approval or rejection

© Copyright 2014, UnitedHealth Group. All Rights Reserved. 8

DRG Registration Guide

Working with the Registration Form

Form completion is covered in the next three sections, each corresponding to the three parts of the form. Functionality around other DRG tasks is fully explained after Form Completion—Part 3.

Several actions may be completed with a DRG Registration Form, depending on the role you are certified for.

Note: A registration ID is not assigned until after a completed registration is submitted.

Required Action Purpose Starting Point

Access a new registration

Complete a brand new DRG Registration Form

Select the Create a new DRG Registration or Recertify a previous Registration link under Pages in left navigation pane on the DRG SharePoint site

Edit an existing registration

Make changes to a registration that has not yet been submitted

Select the Request Search link (left navigation pane) on the DRG SharePoint site and search for the desired request (for example: by ID number or the name you created for the registration) OR click the Edit link under My Draft Registrations

Load an existing registration

Clone an existing registration to create one similar

The top field (Load) of any open form

Review a release (Approver)

Assess the risk, business need an business process behind a data release registration

DRG dashboard under the Review Registrations section

Re-certify a registration

(Submitter)

Renew an existing request for the coming year or an alternate option to link and retire.

Load section (top of form) in any new or existing form OR Submit (Part 3 of the form

Search for a registration

Find a registration to edit, review, verify, recertify or withdraw it

DRG Registration Search link from SharePoint DRG Registration page

Verify a registration

(Approver)

Review to verify the success of an Ad Hoc release

Access this form on the DRG Home page, immediately under the DRG Registration form link

Withdraw a registration

(Submitter)

Cancel the request and dispose of existing form. A registration can be withdrawn as long as it has not been approved. If approved, must retire instead

Click the Withdraw link under My Submitted Registrations on the dashboard.

© Copyright 2014, UnitedHealth Group. All Rights Reserved. 9

DRG Registration Guide

Common Field Types and Functions

Button: Clicking one initiates the action displayed on the button.

Text or numeric field: Accepts keyed or copy/pasted entry. It requires that you click inside the field to place the cursor before typing. Character length may range from 100 (one row text fields) to 250 (large description fields).

Text fields on narrow rows are easy to overlook. If you neglect to add entry to a required text field, you will not be allowed to submit the registration. Review all entry on Part 1 of the form, especially before continuing to the next page.

Check Names icon: Assesses the entry to see if it matches any name record. For data to be recovered, the person’s entire name--last, first, and middle initial--must be typed exactly as it is in the record. Spelling errors, typing issues, or no record existing returns the message: No exact match was found.

Browse icon: Displays a dialog box for you to:

1. In the Find field, click and key a portion of a person’s name.

2. Pressing Enter or clicking the magnifying glass icon engages the search.

3. Records closely matching the supplied text display below the Find field.

4. Double-click on the desired name OR single-click it and click the OK button to populate the text field

People Picker: Contains a text field, Check Names, and Browse icons.

© Copyright 2014, UnitedHealth Group. All Rights Reserved. 10

DRG Registration Guide

Radio button: Accepts only one selection.

Checkbox: Accepts more than one selection. Click as many as fit your needs.

Scrollable field: May accept text explanations or contain checkbox fields. For this checkbox field type, scroll to the end to review all choices.

Drop-down list: Upon clicking the down arrow, it displays a list of options to select from. Clicking the option populates the field.

Table and Button: Click the button to initiate a series of actions to be completed in new fields that are displayed below. When clicking a Finish or Save… button after completing the added fields, the form reconfigures to the original display, showing a row populated with your entry.

Actions links: Usually are displayed inside an Action column. They allow the registration to be used or altered in some way. Common links include Edit, Copy, Delete, View, and Withdraw.

The fields described below begin at the top of the form and end with the buttons at the end of Part 1 of the form.

Form Completion—Part 1: General The DRG Registration Form contains a set of standard questions and fields for responses. The form has three parts: General, External Entities, and Submit.

© Copyright 2014, UnitedHealth Group. All Rights Reserved. 11

DRG Registration Guide

Part 1 of the form contains the following sections:

Load Registration

Contact Information

Requesting Source

Registration Details

General Registration Details

Data Source

Processing Controls

The fields in the DRG Registration Form are documented as follows:

A screen capture of the fields documented is displayed on the page.

Each field is explained separately in this format:

o Field or question text in boldfaced type

o Purpose with whether the field is Required, Optional, Autofill, or Conditionally Required. A Conditionally Required field means that if the form reconfigures to display the field, you must complete it.

o Procedure steps or options listing, depending on what is relevant. This includes a full explanation of how the interface works or what the option means as well as the implications of selecting the option.

o Note: any additional relevant information

o Troubleshoot: what to do if your selection negatively does not allow you to submit the form or other common problems.

If the field does not require some of the information above, it will be omitted.

© Copyright 2014, UnitedHealth Group. All Rights Reserved. 12

DRG Registration Guide

Load

Purpose: Optional. Use this part of the form when to work with a previously submitted or approved registration. You may use this section to:

Clone an existing registration to create a new one similar to it

Look up a current registration to recertify or link it to another one for tracking or reference purposes

Find a registration to retire it

Procedure:

1. Click in the Registration ID field and key the desired registration’s assigned number. If you don’t know the registration number, return to the DRG Dashboard to find it.

2. If needed, click in the Year and Version number fields to record these details for reference or continuity purposes. Scenario: This is the fourth version of this specific registration we created in 2014. So, you would key “14” and “4” in the fields.

3. Click the Load Registration button. This engages the search engine.

Note: A registration is not assigned a registration ID until it has been successfully submitted.

Troubleshoot:

Check the DRG Dashboard to see if the desired registration is in My Draft Registrations or My Submitted Registrations. If you recorded the registration ID of a withdrawn registration, you may search using that.

Check the number you entered to see if you keyed it accurately.

© Copyright 2014, UnitedHealth Group. All Rights Reserved. 13

AB

C

A

B

C

DRG Registration Guide

Contact Information

Submitter

Purpose: Autofill. Shows who created the registration. The fields include: the Submitter’s name, system user ID, MS ID: identifies an active user within UnitedHealth Group’s environment, cube location, external email address, business segment, division, and manager’s name.

Select Backup to the Submitter

Purpose: Optional. Select the person whom to contact if you are unavailable.

Procedure:

1. Use the People Picker to find the individual and select them.

2. The selection autofills all the fields. See Submitter above for a description of the fields’ contents.

Requesting Source

Purpose: Required. Indicate the person who alerted you to the business need for releasing data.

Procedure:

1. Use the People Picker to find the individual and select them.

2. The selection autofills all the fields. See Submitter above for a description of the fields’ contents.

© Copyright 2014, UnitedHealth Group. All Rights Reserved. 14

A

B

A

B

C

C

DRG Registration Guide

Registration Details

This section is where you supply the high level details for the data release. This is also where you specify whether the registration is for an Ad Hoc (one time) or Business Process (recurring) data release.

Enter the name of this Registration:

Purpose: Required. Give the registration a name that it can be referred to by. Example: Cancer Research for CDC.

Procedure: Click in the field and key the name or title for the registration and subsequent data release.

Registration Summary:

Purpose: Required. Enter a complete description of the registered data release, its purpose and intent. Example: Delivering records as mandated by the government to the CDC for yearly statistical analysis and compilation.

Procedure: Click in the field and key the summary.

Is this a one time/Ad Hoc release?

Purpose: Required. Identifies whether the release is a one-time occurrence or if it will recur periodically.

Options:

Yes: This is an Ad Hoc release; continue to the General Registration section below it.

No: The form reconfigures. Several Business Process-specific fields display below this field. Those fields will be described next.

Before attempting to register for a Business Process release, certain requirements must be met. Example: Having a fully documented and repeatable segment/group business process for the release, having quality reviews and training in place for stakeholders, ensuring that the process is followed completely and consistently, etc. See the Getting Started section at the beginning of this guide for a complete list of requirements.

Note: In the subsequent fields, if a selection made is counter to the requirements for a Business Process data release, the form will reconfigure and present an Ad Hoc Information agreement.

© Copyright 2014, UnitedHealth Group. All Rights Reserved. 15

A

ABC

B

C

DRG Registration Guide

Business Process-specific Fields

Is your Business Process fully documented (process and/or procedures, workflow, etc.)?

Purpose: Required. Ascertain whether the steps leading up to and surrounding the data release has been thought through and captured for posterity. A recurring release requires this.

Options:

Yes: Your business has completed an essential requirement for releasing data. You may continue to the next field.

No: The form displays an Ad Hoc Information field with a disclaimer. The reasoning behind this is that unless the release is required for a repeatable fully documented business need, it is a one-time only request. You will be presented fields for an Ad Hoc data release in the rest of the form.

Ad Hoc Information Agreement

Purpose: Conditionally Required. Only is displayed if your selection(s) within the Business Process field(s) indicate(s) that your registration does not fit the requirements for a recurring release. It requires a changed approach to the current registration, given your current selections or that you change your selections.

Options:

I Agree: This allows you to continue registering the data release to the General Registration Details section. It means the data will be released only one time.

Cancel: This causes the Ad Hoc Information field to go away, allowing you to alter your selection(s) in the previous field(s). This means that due diligence will be performed on the data (it has a fully documented repeatable process) within the business segment and that it is being released for the same reason each time.

Troubleshoot: If your data release must be registered as a recurring event, you have two options:

Your business group/segment must document its process before registering for the data release. See Getting Started for a list of business process documentation requirements.

Request a one-time release for this single event, then ensure the process is documented and re-register for a Business Process/recurring release before the next time the data needs to go out.

© Copyright 2014, UnitedHealth Group. All Rights Reserved. 16

A

B

A

B

DRG Registration Guide

Additional Business Process-specific Fields

A link to your Business Process documentation is required.

Purpose: Required. Allows your designated Approver to peruse the business process. They must see if has included all requirements to ensure data accuracy, safety and quality. See Getting Started for a list of business process documentation requirements.

Procedure: Click in the field and either key the path, URL, etc. or copy/paste it into the field.

Note: Please be sure that the Approver you designate later in the form has access to this drive, SharePoint site path, or other website.

Is the documented process followed?

Purpose: Required. Allows your designated Approver to assess the documented process.

Options:

All of the Time: Means that the process is always following, showing a dedication to quality, etc.

Some of the Time: Shows that the process is followed intermittently, putting the data at risk. You will not be allowed to submit the registration because it is a control risk. Selecting this option displays an alert: You may not continue.

Rarely or Never: Means that currently data safety and quality is lacking. You will not be allowed to submit the registration because it is a control risk. Selecting this option displays an alert: You may not continue.

What best describes the action taken within the process from start to finish?

Purpose: Required. Allows the Approver insight into how the data for the release is processed within the requesting business segment.

Options:

Manual: All processing is done by an employee(s)

Fully Automated: All data collation, testing, and quality checking is done behind the scenes through computer processes.

Mixed: Some of the work is done via computers and some is done by hand. Example: an employee downloads data from an existing report into Excel and removes unnecessary data.

Will this process be used to release data for the same business purpose every time?

Purpose: Required. Used by the Approver to understand if the reason for the release changes from time to time.

Options:

© Copyright 2014, UnitedHealth Group. All Rights Reserved. 17

B

C

A

B

A

D

C

D

DRG Registration Guide

Yes: The consistency and purpose of the data released is assured. No negative implications apply.

No: The form displayed an Ad Hoc Information field with a disclaimer. The reasoning behind this is that when the business reason behind release changes, it is a one-time only request. You will be presented an Ad Hoc Information agreement. See B on the previous page.

© Copyright 2014, UnitedHealth Group. All Rights Reserved. 18

DRG Registration Guide

General Registration Details

This section records the business reason behind the release as well as Approver and Reviewer role holders and the UnitedHealth Group business areas releasing the data.

Provide the business justification for the data release:

Purpose: Required. Describe why the data is being released and how this supports your organization’s business goals.

Procedure: Use the text field to key in the valid business reason behind registering this release of protected data. Example: Due to contractual obligations the members will receive EOBs on a quarterly basis.

Select the type of Registration:

Purpose: Required. Identifies the general kind of business activity that is driving the data release for this registration.

Options:

Option Definition

Audit The records of activity that involves checking existing work against requirements like laws, regulations, policy, standards, best practices, etc.

Case Management The records around members’ treatment plan and outcomes

Claims The records of the costs of care submitted by a provider or patient to a health insurance organization.

Clinical The techniques and approaches utilized in treating health conditions

Customer Mailing Member logistical information like name, address, city, state, and zip code, or email address

Disease Management The process of coordinating communications and healthcare interventions for populations with illnesses for which self-care is important.

Eligibility Ability of individuals to meet requirements for coverage.

Enrollment The process of covered individuals making decisions about the healthcare plans they desire.

Exchange The marketplace set up to facilitate the purchase of health insurance

Financial The accounting and costs around healthcare and how they’re handled

Health Information Data about members and their physical and mental condition(s)

Human Resources The efforts practiced by a company to support its workforce and their needs

Legal The issues, practices, and situations involving lawful and unlawful application of healthcare and its payment/funding.

Marketing/Sales Information used to promote the services and products of the company

Member Services The activity around responding and caring for the individuals covered

© Copyright 2014, UnitedHealth Group. All Rights Reserved. 19

A

B

A

B

DRG Registration Guide

Option Definition

by our policies

Other An activity not defined in any of the listed options

Provider Network A group of professionals or institutions joined together to offer healthcare services

Regulatory Compliance with federal, state, and local healthcare rules and requirements

Utilization Appropriateness, necessity, and quality of healthcare services

Vendor Service The activity around managing vendor relationships

Wellness Prevention of disease for prolonging of life.

If you select Other, the form reconfigures to display a text field below the Describe your Registration type field

Describe your Registration type:

Purpose: Conditionally Required. Provide a description or explanation for the business activity that calls for the release of protected data.

Procedure: Click in the field and key the text that describes the activity

© Copyright 2014, UnitedHealth Group. All Rights Reserved. 20

C

C

DRG Registration Guide

These General Details fields reconfigure after the Business Segment and Business Group fields are populated. This causes the drop-down fields to display only those options relevant to the business segment and group selected.

Which Business Segment is responsible to the recipient for this data release?

Purpose: Required. Identifies the organization within UnitedHealth Group that initiated the data release. This overall group is responsible for the due diligence required for releasing the registered data.

Procedure: Select the overall organization from which the request for a data release is coming.

Troubleshoot: If you don’t see the specific organization’s name, it could be that you are representing and acting on behalf of an entity considered an M&A organization. Select your organization as the Business Segment acting on their behalf. See Appendix for more information on M & As and the DRG registration process.

Which Business Group is responsible for this data release?

Purpose: Required. The subgroup within the business segment initiating and providing oversight of the data release registered for.

Options: Only those functional areas within the previously selected business segment will display.

Select the Preferred Approver for Your Registration

Purpose: Required. Indicate the name of the individual certified to approve/reject this request for a data release.

Options: Only the Certified Approvers within the previously selected business segment and group are displayed.

Troubleshoot: If the individual has not taken the courses and passed the test to become certified, their name will not display in the drop-down list. However, any individual listed for your group is qualified to perform the duties.

Select the Preferred Reviewer for Your Registration

Purpose: Required. Select the name of the person certified and positioned to act on and review this registration from their DRG dashboard.

Options: Only the Certified Reviewers within the previously selected business segment and group display. They are only required to serve if the release is deemed high risk.

Troubleshoot: If the individual has not taken the courses and passed the test to become certified, their name will not display in the drop-down list. However, any individual listed for your group is qualified to perform the duties.

© Copyright 2014, UnitedHealth Group. All Rights Reserved. 21

A

B

C

D

ABCD