1_AttachmentJ-13.pdf

INSTRUCTIONS FOR COMPLETING THE DATA USE AGREEMENT (DUA)

(AGREEMENT FOR USE OF CENTERS FOR MEDICARE & MEDICAID SERVICES

(CMS) DATA CONTAINING INDIVIDUAL IDENTIFIERS)

This agreement is needed as part of the review of your data request to ensure compliance to the requirements of the Privacy Act, and must be completed prior to the release of specified data files containing individual identifiers.

Directions for the completion of the agreement follow:

Before completing the DUA, please note the language contained in this agreement cannot be altered in any form.

o First paragraph, enter the Requestor==s Organization Name.

o Item #1, enter the Requestor==s Organization Name.

o Item #4, enter the Custodian Name, Company/Organization, Address, Phone Number (including area code), and E-Mail Address (if applicable). The Custodian of files is defined as that person who will have actual possession of and responsibility for the data files. This section should be completed even if the Custodian and Requestor are the same.

o Item #5 will be completed by a CMS representative.

o Item #6 is to be completed with the Study and or Project Name and a brief description of the purpose for which the file(s) will be used.

o Item #7 should delineate the files and years the Requestor is requesting. Specific file names should be completed. If these are unknown, you may contact a CMS representative.

o Item #8, complete by entering the Study/Project==s date of completion.

o Item #15 will be completed by CMS.

o Item #19 is to be completed by Requestor.

o Item #20 is to be completed by Custodian.

o Item #21 will be completed by a CMS representative.

o Item #22 should be completed if your study is funded by another Federal Agency. The Federal Agency Name (Other than CMS) should be entered in the blank. The Federal Project Officer should complete and sign the remaining portions of this section. If this does not apply, leave blank.

o Item #23 will be completed by a CMS representative.

Once the DUA is received and reviewed for privacy issues, a completed and signed copy will be sent to the Requestor for their files.

DUA # ___________

DATA USE AGREEMENT

AGREEMENT FOR USE OF

CENTERS FOR MEDICARE & MEDICAID SERVICES (CMS)

DATA CONTAINING INDIVIDUAL-SPECIFIC INFORMATION)

In order to secure data that resides in a CMS Privacy Act System of Records, and in order to ensure the integrity, security, and confidentiality of information maintained by the CMS, and to permit appropriate disclosure and use of such data as permitted by law, CMS and _________________________________________________ enter into this agreement to comply with the following specific paragraphs.

1. This Agreement is by and between the Centers for Medicare & Medicaid Services (CMS) , a component of the U.S. Department of Health and Human Services (DHHS), and ___________ ____________________________, hereinafter termed “User.”

2. This Agreement addresses the conditions under which CMS will disclose and the User will obtain and use the CMS data file(s) specified in section 7. This Agreement supersedes any and all agreements between the parties with respect to the use of data from the files specified in section 7 and preempts and overrides any instructions, directions, agreements, or other understanding in or pertaining to any grant award or other prior communication from the Department of Health and Human Services or any of its components with respect to the data specified herein. Further, the terms of this Agreement can be changed only by a written modification to this Agreement or by the parties adopting a new agreement.

The parties agree further that instructions or interpretations issued to the User concerning this Agreement or the data specified herein, shall not be valid unless issued in writing by the CMS point-of-contact specified in section 5 or the CMS signatory to this Agreement shown in section 22.

3. The parties mutually agree that CMS retains all ownership rights to the data file(s) referred to in this Agreement, and that the User does not obtain any right, title, or interest in any of the data furnished by CMS.

4. The parties mutually agree that the following named individual is designated as ACustodian@ of the file(s) on behalf of the User and the person will be responsible for the observance of all conditions of use and for establishment and maintenance of security arrangements as specified in this Agreement to prevent unauthorized use. The User agrees to notify CMS within fifteen (15) days of any change of custodianship. The parties mutually agree that CMS may disapprove the appointment of a custodian or may require the appointment of a new custodian at any time.

OMB No. 0938-0734 Rev. 2001

(Name of Custodian)

(Company/Organization)

(Street Address)

(City/State/ZIP Code)

(Phone No. - Including Area Code and E-Mail Address, If Applicable)

5. The parties mutually agree that the following named individual will be designated as Apoint-of-contact@ for the Agreement on behalf of CMS.

(Name of Contact)

(Title/Component)

(Street Address)

(Mail Stop)

(City/State/ZIP Code)

(Phone No. - Including Area Code and E-Mail Address, If Applicable)

6. The User represents, and in furnishing the data file(s) specified in section 7 CMS relies upon such representation, that such data file(s) will be used solely for the following purpose(s).

The User represents further that the facts and statements made in any study or research protocol or project plan submitted to CMS for each purpose are complete and accurate.

Further, the User represents that said study protocol(s) or project plans, as have been approved by CMS or other appropriate entity as CMS may determine, represent the total use(s) to which the data file(s) specified in section 7 will be put.

The User represents further that, except as specified in an Attachment to this Agreement or except as CMS shall authorize in writing, the User shall not disclose, release, reveal, show, sell, rent, lease, loan, or otherwise grant access to the data covered by this Agreement to any person. The User agrees that, within the User organization, access to the data covered by this Agreement shall be limited to the minimum number of individuals necessary to achieve the purpose stated in this section and to those individuals on a need-to-know basis only.

7. The following CMS data file(s) is/are covered under this Agreement.

File Year(s)

8. The parties mutually agree that the aforesaid file(s) (and/or any derivative file(s) [includes any file that maintains or continues identification of individuals]) may be retained by the User until , hereinafter known as the “retention date.” The User agrees to notify CMS within 30 days of the completion of the purpose specified in section 6 if the purpose is completed before the aforementioned retention date. Upon such notice or retention date, whichever occurs sooner, CMS will notify the User either to return all data files to CMS at the User=s expense or to destroy such data. If CMS elects to have the User destroy the data, the User agrees to certify the destruction of the files in writing within 30 days of receiving CMS=s instruction. A statement certifying this action must be sent to CMS.

If CMS elects to have the data returned, the User agrees to return all files to CMS within 30 days of receiving notice to that effect. The User agrees that no data from CMS records, or any parts thereof, shall be retained when the aforementioned file(s) are returned or destroyed unless authorization in writing for the retention of such file(s) has been received from the appropriate Systems Manager or the person designated in item No. 22 of this Agreement.

The User acknowledges that stringent adherence to the aforementioned retention date is required, and that the User shall ask CMS for instructions under this paragraph if instructions have not been received after 30 days after the retention date.

The Agreement may be terminated by either party at any time for any reason upon 30 days written notice. Upon such notice, CMS will cease releasing data to the User under this Agreement and will notify the User either to return all previously released data files to CMS at the User’s expense or destroy such data, using the same procedures stated in the above paragraph of this section. Sections 3, 6, 8, 11, 12, 13, 14, 16, 17 and 18 shall survive termination of this Agreement.

9. The User agrees to establish appropriate administrative, technical, and physical safeguards to protect the confidentiality of the data and to prevent unauthorized use or access to it. The safeguards shall provide a level and scope of security that is not less than the level and scope of security established by the Office of Management and Budget (OMB) in OMB Circular No. A-130, Appendix III--Security of Federal Automated Information Systems (http://www.whitehouse.gov/omb/circulars/a130/a130.html), which sets forth guidelines for security plans for automated information systems in Federal agencies. The User acknowledges that the use of unsecured telecommunications, including the Internet, to transmit individually identifiable or deducible information derived from the file(s) specified in section 7 is prohibited. Further, the User agrees that the data must not be physically moved or transmitted in any way from the site indicated in item number 4 without written approval from

CMS.

10. The User agrees that the authorized representatives of CMS or DHHS Office of the Inspector General will be granted access to premises where the aforesaid file(s) are kept for the purpose of inspecting security arrangements confirming whether the User is in compliance with the security requirements specified in paragraph 9.

11. The User agrees that no findings, listing, or information derived from the file(s) specified in section 7, with or without identifiers, may be released if such findings, listing, or information contain any combination of data elements that might allow the deduction of a beneficiary=s identification without first obtaining written authorization from the appropriate System Manager or the person designated in item number 22 of this Agreement. Examples of such data elements include but are not limited to geographic indicator, age, sex, diagnosis, procedure, admission/discharge date(s), or date of death. The User agrees further that CMS shall be the sole judge as to whether any finding, listing, information, or any combination of data extracted or derived from CMS=s files identifies or would, with reasonable effort, permit one to identify an individual or to deduce the identity of an individual to a reasonable degree of certainty.

12. The User agrees that, absent express written authorization from the appropriate System Manager or the person designated in item number 22 of this Agreement to do so, the User shall make no attempt to link records included in the file(s) specified in section 7 to any other identifiable source of information. This includes attempts to link to other CMS data file(s). The inclusion of linkage of specific files in a study protocol approved in accordance with section 6 is considered express written authorization from CMS.

13. The User agrees to submit to CMS a copy of all findings within 30 days of making such findings. The parties mutually agree that the User has Amade findings@ with respect to the data covered by this Agreement when the User prepares any report or other writing for submission to any third party (including but not limited to any manuscript to be submitted for publication) concerning any purpose specified in section 6 (regardless of whether the report or other writing expressly refers to such purpose, to CMS, or to the files specified in section 7 or any data derived from such files). The User agrees not to submit such findings to any third party until receiving CMS=s approval to do so. CMS agrees to make determination about approval and to notify the user within 4 to 6 weeks after receipt of findings. CMS review of the findings is for the sole purpose of assuring that data confidentiality is maintained and that individual beneficiaries could not be identified. CMS may withhold approval for publication only if it determines that the format in which data are presented may result in identification of individual beneficiaries. The User agrees further to submit its findings to the National Technical Information Service (NTIS, 5285 Port Royal Road, Springfield, Virginia 22161) within 30 days of receiving notice from CMS to do so.

14. The User understands and agrees that they may not reuse original or derivative data file(s) without prior written approval from the appropriate System Manager or the person designated in section 22 of this Agreement.

15. The parties mutually agree that the following specified Attachments are part of this Agreement:

16. The User agrees that in the event CMS determines or has a reasonable belief that the User has made or may have made disclosure of the aforesaid file(s) that is not authorized by this Agreement or other written authorization from the appropriate System Manager or the person designated in item number 22 of this Agreement, CMS in its sole discretion may require the User to: (a) promptly investigate and report to CMS the User=s determinations regarding any alleged or actual unauthorized disclosure, (b) promptly resolve any problems identified by the investigation; (c) if requested by CMS, submit a formal response to an allegation of unauthorized disclosure; (d) if requested by CMS, submit a corrective action plan with steps designed to prevent any future unauthorized disclosures; and (e) if requested by CMS, return data files to CMS. The User understands that as a result of CMS=s determination or reasonable belief that unauthorized disclosures have taken place, CMS may refuse to release further CMS data to the User for a period of time to be determined by CMS.

17. The User hereby acknowledges that criminal penalties under ' 1106(a) of the Social Security Act (42 U.S.C. ' 1306(a)), including a fine not exceeding $5,000 or imprisonment not exceeding 5 years, or both, may apply with to disclosures of information that are covered by ' 1106 and that are not authorized by regulation or by Federal law. The User further acknowledges that criminal penalties under the Privacy Act (5 U.S.C. ' 552a(i) (3)) may apply if it is determined that the Requestor or Custodian, or any individual employed or affiliated therewith, knowingly and willfully obtained the file(s) under false pretenses. Any person found guilty under the Privacy Act shall be guilty of a misdemeanor and fined not more than $5,000. Finally, the User acknowledges that criminal penalties may be imposed under 18 U.S.C. ' 641 if it is determined that the User, or any individual employed or affiliated therewith, has taken or converted to his own use data file(s), or received the file(s) knowing that they were stolen or converted. Under such circumstances, they shall be fined under Title 18 or imprisoned not more than ten years, or both; but if the value of such property does not exceed the sum of $1,000, they shall be fined under Title 18 or imprisoned not more than one year, or both.

18. By signing this Agreement, the User agrees to abide by all provisions set out in this Agreement for protection of the data file(s) specified in section 7, and acknowledges having received notice of potential criminal or administrative penalties for violation of the terms of the Agreement.

19. On behalf of the User the undersigned individual hereby attests that he or she is authorized to enter into this Agreement and agrees to all the terms specified herein.

(Name and Title of Individual - Typed or Printed)

(Company/Organization)

(Street Address)

(City/State/ZIP Code)

(Phone No. - Including Area Code and E-Mail Address, If Applicable)

(Signature) (Date)

20. The Custodian, as named in paragraph 4, hereby acknowledges his/her appointment as Custodian of the aforesaid file(s) on behalf of the User, and agrees and in his capacity as an employee of the User to comply with all of the provisions of this Agreement on behalf of the User.

(Typed or Printed Name and Title of Custodian of File(s)

(Signature) (Date)

21. The disclosure provision(s) that allows the discretionary release of CMS data for the purpose(s) stated in paragraph 6 follow(s). (To be completed by CMS staff.)

22. On behalf of ___________________________________ the undersigned individual hereby acknowledges that the aforesaid Federal agency sponsors or otherwise supports the User=s request for and use of CMS data, agrees to support CMS in ensuring that the User maintains and uses CMS=s data in accordance with the terms of this Agreement, and agrees further to make no statement to the User concerning the interpretation of the terms of this Agreement and to refer all question of such interpretation or compliance with the terms of this Agreement to the CMS official named in section 22 (or to his or her successor).

(Typed or Printed Name and Title of Federal Representative)

(Signature) (Date)

(Phone No. - Including Area Code and E-Mail Address, If Applicable)

23. On behalf of CMS the undersigned individual hereby attests that he or she is authorized to enter into this Agreement and agrees to all the terms specified herein.

(Typed or Printed Name and Title of CMS Representative)

(Signature) (Date)

According to the Paperwork Reduction Act of 1995, no persons are required to respond to a collection of information unless it displays a valid OMB control number. The valid OMB control number for this information collection is 0938-0734. The time required to complete this information collection is estimated to average 30 minutes per response, including the time to review instructions, search existing data resources, gather the data needed, and complete and review the information collection. If you have any comments concerning the accuracy of the time estimate(s) or suggestions for improving this form, please write to: CMS, 7500 Security Boulevard, N2-14-26, Baltimore, Maryland 21244-1850 and to the Office of Information and Regulatory Affairs, Office of Management and Budget, Washington, D.C. 20503.