he Privacy Act of 1976, ?552a requires
the Centers for Medicare & Medicaid Services (CMS) to track all
disclosures of the agency's Personally Identifiable Information
(PII) and the exceptions for these data releases. CMS is also
required by the Health Insurance Portability and Accountability Act
(HIPAA) of 1996 and the Federal Information Security Management Act
(FISMA) of 2002 to properly protect all PII data maintained by the
agency. When entities request CMS PII data, they enter into a Data
Use Agreement (DUA) with CMS. The DUA stipulates that the recipient
of CMS PII data must properly protect the data according to FISMA
and also provide for its appropriate destruction at the completion
of the project/study or the expiration date of the DUA. The DUA
form enables the data recipient and CMS to document the request and
approval for release of CMS PII data. The form requires the
submitter to provide the Requestor's organization; project/study
name; CMS contract number (if applicable); data descriptions and
the years of the data; retention date; attachments to the
agreement; name, title, contact information to include address,
city, state, zip code, phone, e-mail, signature and date signed by
the requester and custodian; disclosure provision; name of Federal
Agency sponsor; Federal Representative name, title, contact
information, signature, date; CMS representative name, title,
contact information, signature and date; and
concurrence/non-concurrence signatures and dates from 3 CMS System
Manager or Business Owners. While the data elements collected are
not subject to change, the individualized clauses that are
incorporated into any specific DUA are subject to change based on a
specific case or situation such as disclosures to states, oversight
agencies or DUAs for disproportionate share hospital (DSH) data
requests as well as updates to DUAs with additional data
descriptions, changes to the requestor or adding custodians to
current DUAs.
US Code:
5
USC 552(a) Name of Law: The Privacy Act of 1974
The burden has increased due to
numerous new CMS sponsored programs which are aimed at getting data
out to the health care community to encourage innovative changes to
reduce the cost of health care for Medicare and Medicaid
beneficiaries. These new programs have increased our work load for
new data use agreements with corresponding increases to the number
of data use agreement addendums and updates.
On behalf of this Federal agency, I certify that
the collection of information encompassed by this request complies
with 5 CFR 1320.9 and the related provisions of 5 CFR
1320.8(b)(3).
The following is a summary of the topics, regarding
the proposed collection of information, that the certification
covers:
(i) Why the information is being collected;
(ii) Use of information;
(iii) Burden estimate;
(iv) Nature of response (voluntary, required for a
benefit, or mandatory);
(v) Nature and extent of confidentiality; and
(vi) Need to display currently valid OMB control
number;
If you are unable to certify compliance with any of
these provisions, identify the item by leaving the box unchecked
and explain the reason in the Supporting Statement.
Form CMS-R-235 Data Use Agreement Information Collection Requirements, Model Language, and Supporting Regulations in 45 CFR Section 5b
CMS-R-235 DUA Supporting_Statement_-_Part_A May 2014.doc
Data Use Agreement Information Collection Requirements, Model Language, and Supporting Regulations in 45 CFR Section 5b