J.6_Data_Use_Request_User_Guide.doc

Attachment J.6 - Task Order 001

HHSM-500-2014-RFP-QIN-QIO

Data Use Request

User Guide Contractor DBA and/or Data Managers are to use this Data Use Request form in Remedy to record requests from outside entities for health information data. A survey template for mailing to the requesting third party and getting the information required for this process can be found as an attachment in the Documentation form record describing this form. When contacted by a third party requestor, the DBA/Data Manager must get this survey information (by some means) for entering into this form and determine if the data being requested is:

1. Public information and can be released freely,

2. Is privacy information and cannot be released, or

3. Is data that requires a Data Use Agreement (DUA) between the Requestor and the contractor that defines the terms of the data release.

The following is a screen shot of the top half of the Data Use Request form:

Field Descriptions:

All entry fields with bold labels are required fields that must be populated for the record to be saved. Italic labeled fields are system populated. Fields with plain text labels are not required to create the record but might become required later in the process.

Requestor Name Type the name of the person making the request for health information data. If the name is in the Data Usage Prohibited form table with a Status of "Prohibited", the system will display an error saying the request cannot be processed and the entry will be cleared.

Requestor Phone# Type the requestor’s phone number.

Requestor Email Address

Type the requestor’s email address.

DUR #

The system will automatically create the value in the format of D- followed by the next higher sequential 5-digit number value as the new record is saved. The user cannot enter or modify this field value.

Create Date This system generated value is the date and time the record is first save. The user cannot enter or modify this field value.

Requestor Organization Name, Requestor Office Address Line 1

These required fields values should be collected for reference when and if a DUA or other document is to be printed and mailed to the requestor.

Requestor Office Address Line 2

Not required but to be used if needed for addressing mail to the Requestor.

Requestor City, Requestor State, Requestor ZIP

This is required information to be referenced for future mail addressing and to fill into blanks in a potential DUA document report.

Change Log This unlimited diary field can be used by any user to add comments or notes. The system adds the date and time of the entry and who caused the entry. Because all entries are permanent this field is also used by the system to auto-log all Status, End Date of Active Analysis, and Date if Later Extended field changes for audit purposes.

Status This is the most important field for tracking and indicating the processing state of the record. The following is the menu of values:

Request Started (default)

DUA Required & Routed

PO Approved

DUA in Effect

Cert. of Destruction Sent

DUA Expired over 30 days

Non-DUA/Closed

PO Denied/Closed

Cert. of D. Rcvd./Closed

The following describes each Status value, when they should be set, and special system workflow that is triggered when set and saved.

Request Started This is the default Status value during initial record entry. It assumes the contractor entry user may not know initially if the data being requested is 1. Public information, 2. Privacy information and can’t be released, or 3. A DUA is required. Once the DBA can determine and set this in the “DBA/Data Mgr Determination” field described later, he/she may change the Status value appropriately or let the system auto-set the Status when saved.

DUA Required & Routed

This Status value may be manually selected by the users or auto-set by the system when the user sets the DBA/Data Mgr Determination field (described later) to "3. DUA is required". The system will also display a dialog box instructing the user to use the Create Report button to print the DUA report and mail it to the Requestor. Finally, the system will email notify the contractor's Project Officer that a DUA has been routed and to supply his/her Yes or No in the PO Approves? field.

PO Approved This Status can be set manually by the Project Officer or will be auto-set by the system when the PO saves a Yes value in the PO Approves? field. The system will also email notify the CMS Central Office contact and the contractor DBA when PO approval is entered as “Yes” and saved.

DUA in Effect When the DUA is returned fully signed by the Requestor and the PO has approved, the DBA should set this Status value. When this Status is set, the system will email notify the CMS Central Office contact about the DUA.

Cert. of Destruction Sent

The system will notify the contractor DBA on the End Date of Active Analysis or Date if Later Extended (whichever is later) as a reminder to print and send the Certification of Destruction to the Requestor. When the contractor sends the Certification of Destruction, he/she should set this Status value. If this Status is not set within 10 business days after the End Date of Active Analysis or Date if Later Extended, a second notification reminder will be sent to the contractor DBA.

DUA Expired over 30 days

The system will set this value if the Status has not been set to Cert. of D. Rcvd./Closed within 30 business days after the End Date of Active Analysis or Date if Later Extended (which ever is later). Also, the system will notify the contractor DBA and CMS Central Office contact that the Certification of Destruction has not been received and that the Requestor’s name has been registered in the Data Usage Prohibited table.

Non-DUA/Closed This value should be selected if the DBA/Data Manager Determination field is set to 1. Data is public information or 2. Data is privacy info, cannot release. The request record is then considered closed.

PO Denied/Closed

The system will set this Status automatically if the Project Officer for the QIO selects “No” for the ‘PO Approves?’ field. The request is considered denied and closed and no DUA is in effect.

Cert. of D. Rcvd./Closed

The contractor user should set this Status as soon as he/she receives the signed Certificate of Destruction from the Requestor. This is important because if not indicated as received within 30 business days after the End Date of Active Analysis or Date if Later Extended, the CMS Central Office contact will be notified and the Requestor will be registered on the Data Usage Prohibited list. Also, legal proceedings could be filed against the requestor.

Create Report button This button only functions when viewing a record in Modify mode after doing a Search. When pressed a dialog box opens that allows the user to select a report from a menu and select a description of the records to include in the report from another menu. The resulting record selection criteria can be modified if not exactly what the user desires.

The Data Description tab:

Detailed Data Description

This field allows up to 2000 characters of information for describing the data being requested. It must be complete and accurate. The contents of this field will also be printed in the Certification of Destruction report document.

End Date of Active Analysis This date indicates when the Requestor will be done with the data study and/or analysis. The system will log this date entry in the Change Log.

Also, on this date or the extension date (see the next field), the system will email notify the DBA/Data Manager instructing him/her to produce and send the Certification of Destruction to the Requestor and set the Status to "Cert. Of Destruction Sent".

Date if Later Extended

If the Requestor asks for extending the End Date for analysis and the QIO agrees with the extension, enter the new end date in this field. This then becomes the trigger date for various emails and actions previously described for the End Date of Active Analysis.

Note:

This extension must be recorded at least 30 days before the End Date of Active Analysis date value or an error will prevent this extension entry. Also, the DBA/Data Manager should not agree to any more than a one year extension.

Name of Data Custodian:

Enter the name of the person personally responsible for the observance of all conditions of use and for establishment and maintenance of security arrangements to prevent unauthorized use of the data at the requestor site.

Who will have access to the data?

This 2000 character field should have the name of the manager that oversees all users that will access the requested data and the names of all users that will have access to the requested data.

What security systems and policies are in place?

This 2000 character field should be used to describe as accurately and completely as possible the security policies that the requestor site has in place to protect the data. However, if this information is in a document that is attached in the following attachment field, indicate “See Attachment”.

Purpose of having the data

The requestor needs to describe their purpose for having the data. This information will be printed in DUA Document if one is required for this data request.

Attachment field If the DBA/Data Manager receives a document from the requestor that describes their security systems and policies, then attach that document by right clicking under the File Name column and choosing Add.

Federally Funded?

If the request and data analysis is being funded by a non-CMS federal government agency, select Yes from the menu. If not, select No.

Selecting Yes for Federally Funded will cause four more fields to display as shown in the following partial screen shot.

Name of Federal Funding Agency

Enter the funding agency's name.

Fed. Funding Project Officer Name

Enter the name of the Project Officer for the Federal Funding Agency.

Fund. PO Phone# Enter the phone number of the Project Officer for the Federal Funding Agency.

Fund. PO Approved Select Yes, No, or NA from the menu.

The Contractor tab:

Site Code

Select the code for your site from the menu.

Company Name The system will auto-fill this field when the site code is selected. If this name value is incorrect, correct it and notify the QualityNet Help Desk that the default value was incorrect.

DBA/Data Manager This field will be auto-filled with the name of the Remedy user entering the request information. If another name is desired, change the entry.

DBA/Data Mgr Phone This value will initially be populated with the phone number of the entry person unless the DBA/Data Manager field is manually changed. In that case or if incorrect, enter the number for the DBA/Data Mgr manually.

State (Abbrev.)

The system will auto-fill this field with the 2-character abbreviation when the site code is selected. If this entry is incorrect, enter the correct value.

DBA/Data Mgr Determination

The value of this field must be determined and entered when the request record is first created. Its value is key to how the request is processed. If the data being requested is (1) public information or (2) privacy information, then the system will automatically set the Status field to "Non-DUA/Closed".

If (3) is selected and a DUA is required, then the system will auto-set the Status to "DUA Required & Routed", save the changes, and display the DUA Processing tab which instructs the user to use the Create Report button to print the DUA Document and send to the Requestor. The system will also email notify the contractor’s Project Officer requesting their review of the request record and a Yes or No selection in the Concur? field.

Contract # The system will auto-fill this field when the site code is selected. If this entry is incorrect, enter the correct value.

The DUA Processing tab:

DUA #

This field will be auto-populated after the record has been saved at least once and opened in Modify Mode. Its format will consist of the DUR # from the request record followed by a dash and contractor’s State abbreviation. This value will be printed at the top of the first page of the DUA document report.

Project Officer Name

The system will auto-populate this field when the Site Code field value is selected. If not correct, manually correct it.

PO Email Address The system will auto-populate this field when the Site Code field value is selected. If not correct, manually correct it.

PO Approves?

This field can only be written to by a Project Officer user. The menu presents Yes and No as choices. If No is selected, the Project Officer is required to give a reason. The following partial screen shot shows an additional field that appears:

PO reason if don't approve

If the Project Officer selects No as their PO Approves? field value, they must fill this field with a brief explanation.

The Cert. of Destruction tab:

Date Cert. Rcvd by Contractor The system will auto-populate this field when the Status is set to "Cert. of D. Rcvd./Closed" but can be manually updated by the contractor user.

Date 10 Bus. Days After End Date

The system auto-calculates and populates this date as 10 business days after the End Date of Active Analysis or the Date if Later Extended (whichever is later). This date is used in a Remedy escalation routine that sends a reminder notification to the contractor user if he/she has not set the Status to "Cert. of Destruction Sent" by this date.

Date 30 Bus. Days After End Date

The system auto-calculates and populates this date as 30 business days after the End Date of Active Analysis or the Date if Later Extended (whichever is later). As indicated in the note beside the field, if the Certification of Destruction has not been signed and received from the Requestor and the Status set to "Cert. of D. Rcvd./Closed" by this date, the system will put the Requestor on the Data User Prohibited list and the CMS Central Office contact, contractor DBA, and Project Officer will be notified.

Data Use Request User Guide

_1293368122