DEPARTMENT OF HEALTH AND HUMAN SERVICES CENTERS FOR MEDICARE & MEDICAID SERVICES Form Approved OMB No. 0938-0734 COMPLIANCE PLAN FOR ACCOUNTING FOR DISCLOSURES OF PRIVACY PROTECTED DATA RELEASED FROM A SYSTEM OF RECORDS (SOR) HOUSED IN A STATE-LOCATED SERVER NOTE: This Compliance Plan must be attached to any Data Use Agreement request made by a State health department or Medicaid agency. State SOR from which data is requested (MDS or OASIS) Requestor (name of individual, title, organization) Title Organization State agency in which the SOR server is located State agency technical contact person who will release the data or oversee the release, and who is responsible for ensuring that required disclosure tracking will take place by signing the statement below: Name (print) Office Telephone (Include Area Code) E-Mail Address (If applicable) In accordance with the disclosure requirements of the Privacy Act of 1974 and the Health Insurance Portability and Accountability Act of 1996 (HIPAA), the State indicated above will be able to account for the disclosure of individually identifiable information from the SOR indicated above. We will use the following process to account for disclosures (brief description): Signature Date According to the Paperwork Reduction Act of 1995, no persons are required to respond to a collection of information unless it displays a valid OMB control number. The valid OMB control number for this information collection is 0938-0734. The time required to complete this information collection is estimated to average 30 minutes per response, including the time to review instructions, search existing data resources, gather the data needed, and complete and review the information collection. If you have any comments concerning the accuracy of the time estimate(s) or suggestions for improving this form, please write to: CMS, 7500 Security Boulevard, Attn: Reports Clearance Officer, Baltimore, Maryland 21244-1850. Form CMS-R-0235MC (03/06) EF 03/2006 American LegalNet, Inc. 1 www.USCourtForms.com