DEPARTMENT OF HEALTH AND HUMAN SERVICES CENTERS FOR MEDICARE & MEDICAID SERVICES INSTRUCTIONS FOR COMPLETING THE DISPROPORTIONATE SHARE HOSPITAL DATA USE AGREEMENT (DUA) (AGREEMENT FOR USE OF CENTERS FOR MEDICARE & MEDICAID SERVICES (CMS) DATA CONTAINING INDIVIDUAL IDENTIFIERS) This agreement is needed as part of the review of your data request to ensure compliance to the requirements of the Privacy Act, and must be completed prior to the release of specified data files containing individual identifiers. Directions for the completion of the agreement follow: Before completing the DUA, please note the language contained in this agreement cannot be altered in any form. • Introductory paragraph, enter the User’s Organization Name (Provider Name and Provider Number). • Enter Paragraph 1, enter the User’s Organization Name (Provider Name and Medicare Provider Number). • Paragraph 4 specifies the limited permissible use of the data and the persons and/or entities to whom redisclosure may be made. • Paragraph 5 The MEDPAR data that will be provided will be the data file that was used to calculate the User’s Medicare fraction of the disproportionate patient percentage for the period covered by the request (e.g., the March 2006 update version of the FFY 2005 MEDPAR file) for a provider’s cost year. CMS will specify the routine use under which the data are being requested. • Paragraph 6, is to be completed by the User to indicate how long the data will be retained (the retention date must not exceed 5 years however, CMS will extend the retention date at the request of the User for good cause shown). • Paragraph 11 will be completed by the User. • Paragraph 15 is to be completed by the User. • Paragraph 16, enter the Custodian Name, Company/Organization, Address, Phone Number (including area code), and E-Mail Address (if applicable). The Custodian of files is defined as that entity or person who will have actual possession of and responsibility for the data files (such as a consulting firm and/or attorney who is prosecuting an appeal on behalf of the User-Provider). This paragraph should be completed even if the Custodian and the User are the same. Where more than one Custodian is listed, the data will be sent to the first one listed. Once the DUA is received and reviewed for privacy issues, a completed and signed copy will be sent to the User and Custodian(s) for their files. Form CMS-R-0235D2 (03/08) 1 American LegalNet, Inc. www.FormsWorkflow.com DEPARTMENT OF HEALTH AND HUMAN SERVICES CENTERS FOR MEDICARE & MEDICAID SERVICES Form Approved OMB No. 0938-0734 DSH DATA USE AGREEMENT FOR COST REPORTING PERIODS THAT INCLUDE DECEMBER 8, 2004 AND THEREAFTER DUA # AGREEMENT FOR USE OF CENTERS FOR MEDICARE & MEDICAID SERVICES (CMS) DATA CONTAINING INDIVIDUAL-SPECIFIC INFORMATION In order to secure data that resides in a CMS Privacy Act System of Records, and in order to ensure the integrity, security, and confidentiality of information maintained by the CMS, and to permit appropriate disclosure and use of such data as permitted by law, CMS and enter into (Provider Name and Number) this agreement to comply with the following specific paragraphs. 1. This Agreement is by and between the Centers for Medicare & Medicaid Services (CMS), a component of the U.S. Department of Health and Human Services (DHHS), and (Provider Name and Number) , hereinafter termed “User.” (Provider Name and Number) 2. This Agreement addresses the conditions under which CMS will disclose and User will obtain and use the CMS data file(s) specified in paragraph 5. This Agreement supersedes any and all agreements between the parties with respect to the use of data from the files specified in paragraph 5 and preempts and overrides any instructions, directions, agreements, or other understanding in or pertaining to any grant award or other prior communication from the Department of Health and Human Services or any of its components with respect to the data specified herein. Further, the terms of this Agreement can be changed only by a written modification to this Agreement or by the parties adopting a new agreement. The parties agree further that instructions or interpretations issued to User concerning this Agreement or the data specified herein, shall not be valid unless issued in writing by the CMS point-of-contact specified in paragraph 16 or the CMS signatory to this Agreement shown in paragraph 17. 3. The parties mutually agree that CMS retains all ownership rights to the data file(s) referred to in this Agreement, and that User does not obtain any right, title, or interest in any of the data furnished by CMS. 4. User represents, and in furnishing the data file(s) specified in paragraph 5. CMS relies upon such representation, that such data file(s) will be used solely for the purpose of calculating User’s Medicare fraction of the disproportionate patient percentage. User represents further that User shall not disclose, release, reveal, show, sell, rent, lease, loan, or otherwise grant access to the data covered by this Agreement to any person. Exception: User may disclose, release, reveal or show individually identifiable data to the following entities (including individuals employed by or under contract with such entities) and individuals, to the extent necessary to calculate User’s Medicare fraction of the disproportionate patient percentage: (1) CMS; (2) a fiscal intermediary under contract with CMS; (3) The PRRB; (4) a consultant or attorney or other representative under contract with User to prosecute, or assist in the prosecution of, an administrative and/or judicial appeal of CMS’s calculation of its disproportionate patient percentage; (5) the Department of Justice (6) a Federal court. Any such grant of access by User to individually identifiable data under the foregoing Exception shall be strictly limited to the extent necessary for User to calculate its Medicare fraction of the disproportionate patient percentage – User is expected to redact individually identifiable data and/or use code identifiers wherever possible. User further agrees that, within the User organization, access to the data covered by this Agreement shall be limited to the minimum number of individuals necessary to achieve the purpose stated in this section paragraph and to those individuals on a need-to-know basis only. Form CMS-R-0235D2 (03/08) 2 American LegalNet, Inc. www.FormsWorkflow.com 5. The following CMS data file(s) is/are covered under this Agreement: MEDPAR File Extract Provider Number Provider Cost Reporting Period The above file(s) are being disclosed to User under routine use 3 of the ‘Medicare Provider Analysis and Review (MEDPAR), HHS/CMS/OIS, 09-70-0514’ Privacy Act system of records, published at 71 Fed. Reg. 17470 (April 06, 2006). 6. The parties mutually agree that the aforesaid file(s) (and/or any derivative file(s) (which includes any file that maintains or continues identification of individuals)) may be retained by User no more than 90 days after the date of termination of User’s appeal of CMS’s calculation of its disproportionate patient percentage. For purposes of this paragraph, “date of termination of User’s appeal” shall be the date upon which any of the following events occur: (1) the User abandons its appeal; (2) an order rendered by the PRRB, the CMS Administrator or court upholding CMS’s calculation of User’s disproportionate patient percentage has become final and non-appealable; (3) an order rendered by the PRRB, the CMS Administrator or court awarding additional payment to User with respect to the disproportionate patient percentage (including an order approving a settlement) has become final and non-appealable and such payment has been made to User; (4) an administrative resolution satisfactory to User and to the fiscal intermediary is reached on the appeal, and any additional payment provided for by such resolution, with respect to the disproportionate patient percentage, has been made to User. User agrees to destroy the files(and/or any derivative file(s) (which includes any file that maintains or continues identification of individuals)) after the date of termination of User’s appeal. User agrees that no data from CMS records, or any parts thereof, shall be retained when the aforementioned file(s) are destroyed unless authorization in writing for the retention of such file(s) has been received from the appropriate Systems Manager or the person designated in paragraph 17 of this Agreement. User acknowledges that strict adherence to the aforementioned retention date is required. The Agreement may be terminated by either party at any time for any reason upon 30 days writtennotice. Upon such notice, CMS will cease releasing data to User under this Agreement and will notify User to destroy all previously released data files. Sections 3, 4, 6, 9, 10, 12, 13 and 14 shall survive termination of this Agreement. Form CMS-R-0235D2 (03/08) 3 American LegalNet, Inc. www.FormsWorkflow.com 7. User agrees to establish appropriate administrative, technical, and physical safeguards to protect the confidentiality of the data and to prevent unauthorized use or access to it. The safeguards shall provide a level and scope of security that is not less than the level and scope of security established by the Office of Management and Budget (OMB) in OMB Circular No. A-130, Appendix III—Security of Federal Automated Information Systems (http://www.whitehouse.gov/omb/circulars/a130/a130.html), which sets forth guidelines for security plans for automated information systems in Federal agencies. User acknowledges that the use of unsecured telecommunications, including the Internet, to transmit individually identifiable or deducible information derived from the file(s) specified in paragraph 5 is prohibited. Further, User agrees that the data must not be physically moved or transmitted in any way from the site(s) indicated in paragraph 16, except as provided in paragraph 4, without written approval from CMS. 8. User agrees that the authorized representatives of CMS or DHHS Office of the Inspector General will be granted access to premises where the aforesaid file(s) are kept for the purpose of inspecting security arrangements confirming whether the User is in compliance with the security requirements specified in paragraph 7. 9. The User agrees not to disclose direct findings, listings, or information derived from the file(s) specified in section 5, with or without direct identifiers, if such findings, listings, or information can, by themselves or in combination with other data, be used to deduce an individual’s identity. Examples of such data elements include, but are not limited to geographic location, age if > 89, sex, diagnosis and procedure, admission/discharge date(s), or date of death. The User agrees that any use of CMS data in the creation of any document (manuscript, table, chart, study, report, etc.) concerning the purpose specified in section 4 (regardless of whether the report or other writing expressly refers to such purpose, to CMS, or to the files specified in section 5 or any data derived from such files) must adhere to CMS’ current cell size suppression policy. This policy stipulates that no cell (eg. admittances, discharges, patients) less than 11 may be displayed. Also, no use of percentages or other mathematical formulas may be used if they result in the display of a cell less than 11. By signing this Agreement you hereby agree to abide by these rules and, therefore, will not be required to submit any written documents for CMS review. If you are unsure if you meet the above criteria, you may submit your written products for CMS review. CMS agrees to make a determination about approval and to notify the user within 4 to 6 weeks after receipt of findings. CMS may withhold approval for publication only if it determines that the format in which data are presented may result in identification of individual beneficiaries. 10. User understands and agrees that it may not reuse original or derivative data file(s) without prior written approval from the appropriate System Manager or the person designated in paragraph 17 of this Agreement. 11. The parties mutually agree that the following specified Attachments are part of this Agreement: ❏ NO ATTACHMENTS _____________________________________________________________________________ _____________________________________________________________________________ _____________________________________________________________________________ 12. User agrees that in the event CMS determines or has a reasonable belief that User has made or may have made disclosure of the aforesaid file(s) that is not authorized by this Agreement or other written authorization from the appropriate System Manager or the person designated in paragraph 17 of this Agreement, CMS in its sole discretion may require User to: (a) promptly investigate and report to CMS User’s determinations regarding any alleged or actual unauthorized disclosure, (b) promptly resolve any problems identified by the investigation; (c) if requested by CMS, submit a formal response to an allegation of unauthorized disclosure; (d) if requested by CMS, submit a corrective action plan with steps designed to prevent any future unauthorized disclosures; and (e) if requested by CMS, return data files to CMS. User understands that as a result of CMS’s determination or reasonable belief that unauthorized disclosures have taken place, CMS may refuse to release further CMS data to User for a period of time to be determined by CMS. Form CMS-R-0235D2 (03/08) 4 American LegalNet, Inc. www.FormsWorkflow.com 13. User hereby acknowledges that criminal penalties under § 1106(a) of the Social Security Act (42 U.S.C. § 1306(a)), including a fine not exceeding $5,000 or imprisonment not exceeding 5 years, or both, may apply to disclosures of information that are covered by § 1106 and that are not authorized by regulation or by Federal law. User further acknowledges that criminal penalties under the Privacy Act (5 U.S.C. § 552a(i) (3)) may apply if it is determined that the Requestor, User or Custodian, or any individual employed or affiliated therewith, knowingly and willfully obtained the file(s) under false pretenses. Any person found guilty under the Privacy Act shall be guilty of a misdemeanor and fined not more than $5,000. Finally, User acknowledges that criminal penalties may be imposed under 18 U.S.C. § 641 if it is determined that the User, or any individual employed or affiliated therewith, has taken or converted to his own use data file(s), or received the file(s) knowing that they were stolen or converted. Persons convicted under § 641 shall be fined under Title 18 or imprisoned not more than ten years, or both; but if the value of such property does not exceed the sum of $1,000, they shall be fined under Title 18 or imprisoned not more than one year, or both. 14. By signing this Agreement, User agrees to abide by all provisions set out in this Agreement for protection of the data file(s) specified in paragraph 5, and acknowledges having received notice of potential criminal or administrative penalties for violation of the terms of the Agreement. 15. On behalf of User the undersigned individual hereby attests that he or she is authorized to enter into this Agreement and agrees to all the terms specified herein. Name and Title of User (Representative for Provider) (typed or printed) Provider Name Street Address City Office Telephone (Include Area Code) Signature Form CMS-R-0235D2 (03/08) State ZIP Code E-Mail Address (If applicable) Date 5 American LegalNet, Inc. www.FormsWorkflow.com 16. The parties mutually agree that the following named individual(s) and/or entities is or are designated as Custodian(s) of the file(s) on behalf of User and each person or entity so designated will be responsible for the observance of all conditions of use and for establishment and maintenance of security arrangements as specified in this Agreement to prevent unauthorized use. User is responsible for any non-observance of the conditions of use, and/or failure to establish or maintain security arrangements, on the part of any Custodian. User agrees to notify CMS within fifteen (15) days of any change of custodianship. The parties mutually agree that CMS may disapprove the appointment of a custodian or may require the appointment of a new custodian at any time. Each Custodian agrees and in his or her capacity as an employee or contractor (including consultant, attorney or other representative) of the User to comply with all of the provisions of this Agreement on behalf of User. Name of Custodian (typed or printed) Company/Organization Street Address City State Office Telephone (Include Area Code) ZIP Code E-Mail Address Signature (If applicable) Date 17. The parties mutually agree that the following named individual will be designated as point-of-contact for the Agreement on behalf of CMS. On behalf of CMS the undersigned individual hereby attests that he or she is authorized to enter into this Agreement and agrees to all the terms specified herein. Name of CMS Representative JoAnn Cerne Title/Component Health Insurance Specialist, CMM, Division of Acute Care Street Address Mail Stop 7500 Security Boulevard City Baltimore Office Telephone (Include Area Code) 410-786-4530 Signature C4-08-06 State ZIP Code MD E-Mail Address 21244-1850 (If applicable) Joann.Cerne@cms.hhs.gov Date According to the Paperwork Reduction Act of 1995, no persons are required to respond to a collection of information unless it displays a valid OMB control number. The valid OMB control number for this information collection is 0938-0734. The time required to complete this information collection is estimated to average 30 minutes per response, including the time to review instructions, search existing data resources, gather the data needed, and complete and review the information collection. If you have any comments concerning the accuracy of the time estimate(s) or suggestions for improving this form, please write to: CMS, 7500 Security Boulevard, N2-14-26, Baltimore, Maryland 21244-1850 and to the Office of Information and Regulatory Affairs, Office of Management and Budget, Washington, D.C. 20503. Form CMS-R-0235D2 (03/08) 6 American LegalNet, Inc. www.FormsWorkflow.com