DEPARTMENT OF HEALTH AND HUMAN SERVICES CENTERS FOR MEDICARE & MEDICAID SERVICES INSTRUCTIONS FOR COMPLETING THE MEDICAID AGENCY DATA USE AGREEMENT (DUA) This agreement, which ensures compliance with the requirements of the Privacy Act, is required for a State Medicaid Agency to receive LTC/MDS data deriving from Medicare and private pay residents, and must be completed prior to the release of these files to the Medicaid Agency. No DUA is needed for release of LTC/MDS data derived exclusively from Medicaid residents; however, see the instruction below for item #5 in regard to this. Note that all data releases to the Medicaid Agency, including releases for Medicaid-only residents, must be electronically tracked for purposes of HIPAA compliance. Instructions for the completion of the agreement follow: Before completing the DUA, please note that the language contained in this agreement cannot be altered in any form. · First paragraph, enter the name of the State. · Item #1, enter the name of the State. · Item #5, "Files," is pre-completed to show "LTC/MDS Resident Assessment Data File(s)." This wording is general and covers all MDS data. This all-inclusive language will reliably guide the technical staff who must retrieve the data. Item #5, "Year(s):" The Medicaid Agency may choose the time period for which it wishes to receive data, from a point in the past through up to 10 years into the future (see the Item #6 dis cussion of retention date). Examples are: "1998-2000;" "2001;" and "From 1998 through [insert date 10 years in the future]." · Medicaid Agencies must remain aware that the use of all the MDS data, regardless of program source, is limited to the purpose indicated in Item #4, i.e., for Medicaid program use. In addition, Medicaid Agencies must abide by all the restrictions regarding the MDS data, regardless of source, that are based on the Privacy Act and other law and regulation, and as expressed throughout this DUA. · Item #6 says that the group of data files indicated in Item #5 may be retained by the Medicaid Agency for a period of 10 years after the approval date (CMS' signature date) of the DUA. This date, which is 10 years in the future, is called the "retention date." For cases in which the Medicaid Agency receives data in an ongoing manner, the retention date does not move forward with each data release. For example, data released two months prior to the retention date (9 years and 10 months after the DUA approval date) may only be kept by the Medicaid Agency for two months. If it wishes to continue receiving data beyond the 10 year point, the Medicaid Agency must contact CMS at least 30 days prior to the retention date (and preferably 3-4 months prior) to request another DUA covering the period following the 10 year retention date. · Item #14 is to be completed by the State Medicaid Agency. · Item #15 is to be completed by the State Medicaid Agency Custodian. Enter the Custodian's name, the State Medicaid Agency organizational unit, Address, Phone Number (including area code), and E-Mail Address (if applicable). The Custodian of files is defined as that person who will have actual possession of and responsibility for the data files. This will typically be the manager of the Medicaid agency unit with responsibility for the data files. If the person signing for the Medicaid agency as User is the same person as the Custodian, that person can appear and sign in both places. If there are additional Custodians who are not direct Medicaid agency employees, such as academic or other consulting contractors, who assist the Medicaid agency in its use of the data for the purposes indicated in Item #4, an appropriate lead or managerial person from each such organization must complete and sign the Multi-Signature Addendum form. Form CMS-R-0235M (07/07) EF 07/2007 American LegalNet, Inc. www.FormsWorkFlow.com 1 DEPARTMENT OF HEALTH AND HUMAN SERVICES CENTERS FOR MEDICARE & MEDICAID SERVICES INSTRUCTIONS FOR COMPLETING THE DATA USE AGREEMENT (DUA) Additional Custodian individuals or organizations can be included as necessary over the life of the primary DUA. To include a new Custodian under an existing Medicaid agency DUA, submit the following to the CMS Regional Office: a letter from the Medicaid agency describing the activities planned for the new Custodian and the length of time over which the Custodian will serve; and a Multi-Signature Addendum completed and signed by an appropriate lead or managerial person from the Custodian organization. The Multi-Signature Addendum must show the DUA number of the existing primary Medicaid agency DUA. · Item #16 will be completed by the RO MDS Representative. · Item #17 will be completed by the CMS Regional and Central Office. Form CMS-R-0235M (07/07) EF 07/2007 American LegalNet, Inc. www.FormsWorkFlow.com 2 DEPARTMENT OF HEALTH AND HUMAN SERVICES CENTERS FOR MEDICARE & MEDICAID SERVICES Form Approved OMB No. 0938-0734 MEDICAID AGENCY DATA USE AGREEMENT DUA # AGREEMENT FOR USE OF CENTERS FOR MEDICARE & MEDICAID SERVICES (CMS) DATA CONTAINING INDIVIDUAL-SPECIFIC INFORMATION In order to secure Medicare data that resides in a CMS Privacy Act System of Records, and in order to ensure the integrity, security, and confidentiality of information maintained by CMS, and to permit appropriate disclosure and use of such data as permitted by law, CMS and the State of _________________________________ enter into this agreement to comply with the following specific paragraphs. 1. This Agreement is by and between CMS, a component of the U.S. Department of Health and Human Services (DHHS), and the State of ____________________, hereinafter termed "User." 2. This Agreement addresses the conditions under which CMS will disclose and the User will obtain and use the Medicare Long Term Care Minimum Data Set (LTC/MDS) in section 5. This Agreement supersedes any and all agreements between the parties with respect to the use of the LTC/MDS and preempts and overrides any instructions, directions, agreements or other prior communication from the Department of Health and Human Services with respect to the data specified herein. Further, the terms of this Agreement can be changed only by a written modification to this Agreement, or by the parties adopting a new agreement. The parties agree further that instructions or interpretations issued to the User concerning this Agreement or the data specified herein, shall not be valid unless issued in writing by the CMS