J.6(a)_Data_Use_Agreement.DOCX

Attachment J.6 (a) - Task Order 001

HHSM-500-2014-RFP-QIN-QIO

DATA USE AGREEMENT

Background:

A Data Use Agreement (DUA) is a legal binding agreement between QIO and any external entity (e.g., contractor, private industry, academic institution, other Federal government agency, or state agency), that is agreed upon when an external entity requests the use of QIO personal identifiable data that is covered by the Privacy Act of 1974. The agreement delineates the confidentiality requirements of the Privacy Act, security safeguards, and QIO data use policies and procedures. The DUA serves as both a means of informing the external entity of these requirements and a means of obtaining the external entity agreement to abide by these requirements. Additionally, the DUA serves as a control mechanism through which CMS can track the location of its data and the reason for the release of the data. The need for a DUA is determined by the type of data that is being requested. A Data Use Request Form must be completed in Remedy when requesting QIO data.

Purpose:

The purpose of this section is to provide clear direction and instruction on the process that is used when requesting QIO Data.

Tasks:

When the Data Base Administrator (DBA)/Data Manager are contacted by an external entity, the DBA/Data Manager must obtain all the necessary information needed to properly complete the Data Use Request Form. The Data Use Request Form is used to provide the necessary information needed when requesting identifiable QIO data.

The DBA and/or Data Managers are to use the Data Use Request Form in Remedy to record requests from external entities for Health Information Data. The DBA/Data Manager must then make determination if the data being requested is:

1. Public information and can be released freely,

2. Privacy information and cannot be released, or

3. Data that requires a Data Use Agreement (DUA) between the Requestor and the QIO that defines the terms of the data released.

Once the determination is made on the type of data being requested, the DBA and/or Data Managers shall inform the external entity that the data is privacy information and cannot be released and no additional action is needed; the data is public information and provide them with the data or tell them how to get the data; or a DUA is needed. If a DUA is needed, the QIO shall enter all information pertaining to the DUA in Remedy.

Deliverables:

The Deliverables associated with this Task are:

A monthly report that details at a minimum; all data request received, all DUA’s created, and the status of all current DUA’s.

A quarterly Executive Summary Report that summarizes at a minimum: information on any DUAs that were completed, any Certificates of Destruction (completed, pending and overdue), any requests for extension, and a summary of all monthly reports within that quarter. The Contractor shall also provide other reports as requested by CMS.

All reports are due by COB on the 10th of the following month. All written documents for this project shall be in Microsoft Word format and delivered to the CMS DUA Coordinator via E-mail attachment.