Form CMS-10522 STATE EXECUTIVE SUMMARY FOR RESEARCH IDENTIFIABLE DATA

DEPARTMENT OF HEALTH AND HUMAN SERVICES
CENTERS FOR MEDICARE & MEDICAID SERVICES

Form Approved

OMB No. xxxx-xxxx

STATE EXECUTIVE SUMMARY FOR RESEARCH IDENTIFIABLE DATA

For CMS Use only:
Privacy Board Approval Date

Part D Approval Date

Requesting State Agency (see Item 1 of DUA)

DUA User name and title (see Item 16 of DUA)
Study/Project Title

DATA SHARING

As outlined in the State Data Request Memo from June 2012, CMS is offering States a choice in how they obtain CMS data for
research purposes. States that choose to opt-in to data sharing will only sign one research DUA per State. States that choose
to opt-out of the data sharing may not use or reuse the data without prior written authorization from CMS and will incur the
standard CMS data re-use fees for any requests to re-use or re-disclose the data.
Please indicate your selection below.

Opt-in to data sharing (one research DUA per State)

Opt-out of data sharing (one research DUA per project)

We have signed and included Attachment A to the DUA
and will supply the log of users on a quarterly basis.

We understand that we may not use or reuse the data
without prior written authorization from CMS.

Log of state agencies and other organizations using CMS data
This section specifically identifies each state agency or organization that will be using the data or seeing individual level
results. If a State chooses to opt-in to data sharing (and signs Attachment A to the DUA) this log must be supplied to CMS
([email protected]) on a quarterly basis. States that do not opt-in to data sharing do not need to complete
this log.

STATE DEPARTMENT
(OR CONTRACTOR)

SUMMARY OF RESEARCH PLANS USING
MEDICARE DATA

ACCESS
METHOD*

*If the data will be housed in a separate location from that identified in the DUA, please note the separate location here.
State Executive Summary for Research Identifiable Data (02/14)

1

EXECUTIVE SUMMARY

1. Study Overview Please describe your study objectives and aims.

2. How have you ensured that your data request includes the minimum amount of data necessary to achieve your research objectives?
2.1. Please describe how this cohort will meet minimum data necessary. (Include estimated cohort size. Refer to your cost invoice.)

2.2. List the CMS data files and years being requested at this time and provide justification for how each will be used in the analysis. If
requesting reuse of data, include the DUA #5 to be reused. The list of files should match Item #5 of DUA.
2.2.1. List the Medicare (claims and enrollment) or Medicaid (claims and enrollment) being requested as this time and provide
justification for how each file will be used in the analysis. If requesting reuse of data, include the DUA # to be reused. The list of files
should match item #5 of DUA.

2.2.2. List the Part D event data (if using in study) being requested as this time and provide justification for how each file will be
used in the analysis. If requesting reuse of data, include the DUA # to be reused. The list of files should match item #5 of DUA.

2.2.3. List the Part D characteristics files (if using in study) being requested as this time and provide justification for how each file will
be used in the analysis. If requesting reuse of data, include the DUA # to be reused. The list of files should match item #5 of DUA.

2.2.4. List the Assessment data (if using in study) being requested as this time and provide justification for how each file will be used
in the analysis. If requesting reuse of data, include the DUA # to be reused. The list of files should match item #5 of DUA.

2.3. If this study will require further years of CMS data that are not yet available for request, please list those CMS data files and years
that will be required for the entire scope of your study (Note: Approval of data files for years that are not yet available will NOT be
granted at this time, the information included here will simply provide CMS with an overview of your study).

2.4. Please list any non-identifiable or non-CMS files you are planning to use in conjunction with the above files for your analysis. (e.g.
Provider of Services (POS) file, AMA Physician Master file, etc.)

State Executive Summary for Research Identifiable Data (02/14)

2

3. You are requesting identifiable files. Why can’t Limited Data Set (LDS) files be used for this study?
Please check all that are applicable to this request.
I’m requesting data that are only available as identifiable data (Medicaid, Assessments, Medicare Part D event)

My research requires personal beneficiary identifiers (in order to link to other datasets or to contact Medicare beneficiaries)

My research requires beneficiary DOB, zip code, or physician identifiers.

Other (please explain):

4. Is it feasible to obtain individual level authorization from Medicare/Medicaid beneficiaries for your research? Explain.

5. If you intend on requesting the National Death Index segment of the Master Beneficiary Summary File, please complete the
NDI Supplement.
YES, I’ve included the NDI Supplement

NO, I’m not requesting the NDI

6. If this research project is funded by a commercial entity, the (primary) lead investigator attests that they will limit data sharing with the
funding entity to aggregated analytic results and will retain the right to independently prepare publications of the study results.
I attest
Signature of (Primary) Lead Investigator

Date

DISSEMINATION AND REPORTING OF FINDINGS

From the CMS DUA, “The User agrees that any use of CMS data in the creation of any document (manuscript, table, chart,
study, report, etc.) concerning the purpose specified in section 4 (regardless of whether the report or other writing expressly
refers to such purpose, to CMS, or to the files specified in section 5 or any data derived from such files) must adhere to CMS’
current cell size suppression policy. This policy stipulates that no cell (e.g. admittances, discharges, patients, services) 10 or less
may be displayed. Also, no use of percentages or other mathematical formulas may be used if they result in the display of a
cell 10 or less.“
I agree.
Please describe your plans for disseminating the findings from your analysis, including specific media through which you will report results.

State Executive Summary for Research Identifiable Data (02/14)

3

DATA MANAGEMENT PLAN

Please reference the Data Management Plan Guidelines, Data Management Plan Review Checklist Evaluation Guide,

Collaborator Checklist, and/or the FAQ document for more information on completing this section. These materials are found

under the Executive Summary section of the New Study Requesting Data page of the website.

1. PHYSICAL POSSESSION AND STORAGE OF CMS DATA FILES

1.1. Who will have the main responsibility for organizing, storing, and archiving the data? Please provide name(s) and job title(s).

1.2. Explain the infrastructure (facilities, hardware, software, other) that will secure the CMS data files.

2. DATA SHARING, ELECTRONIC TRANSMISSION, DISTRIBUTION

2.1. Describe your organization’s policies and procedures* regarding the sharing, transmission, and distribution of CMS data files.

2.2. Please indicate how you will allow other state agencies (and/or contractors) to access the data files:
VPN connection
Will travel to physical location of data files at requesting organization
Request that a copy of the data files be housed at second location

Other:

2.3. If an additional copy of the data will be housed in a separate location, please describe how the data will be transferred to this
location. (Also, please ensure you have included information on this organization’s data management under the appropriate
subsections of the data management plan.)

2.4. Who will have the main responsibility for notifying CMS of any suspected incidents wherein the security and privacy of the CMS data
may have been compromised? Please describe and identify your organization’s policies and procedures* for responding to potential
breaches in the security and privacy of the CMS data.

* Note that CMS is specifically asking for references to written policies and procedures related to your organization’s administrative, technical and physical
safeguards. If policies and procedures have not been developed, please explain any ongoing activities your organization is taking to document policies and
procedures and make them available to staff. Organizations selected for DPSP reviews will be asked to provide copies of written policies and procedures. Please
note that an explanation of the process is not sufficient.

State Executive Summary for Research Identifiable Data (02/14)

4

3. COMPLETION OF RESEARCH TASKS AND DATA DESTRUCTION

3.1. In the event that the state is required by CMS to stop all research activities with CMS data, describe your organization’s process to
complete the Certificate of Disposition form and policies and procedures* to destroy data files.

3.2. In the event that the state is required by CMS to stop all research activities with CMS data, describe your organization’s policies and
procedures* to ensure original data files are not used following notice from CMS.

* Note that CMS is specifically asking for references to written policies and procedures related to your organization’s administrative, technical and physical
safeguards. If policies and procedures have not been developed, please explain any ongoing activities your organization is taking to document policies and
procedures and make them available to staff. Organizations selected for DPSP reviews will be asked to provide copies of written policies and procedures. Please
note that an explanation of the process is not sufficient.

PRA Disclosure Statement: According to the Paperwork Reduction Act of 1995, no persons are required to respond to a collection of information unless it displays a
valid OMB control number. The valid OMB control number for this information collection is 0938-XXXX. The time required to complete this information collection
is estimated to average two hours per response, including the time to review instructions, search existing data resources, gather the data needed, and complete
and review the information collection. If you have comments concerning the accuracy of the time estimate(s) or suggestions for improving this form, please write
to: CMS, 7500 Security Boulevard, Attn: PRA Reports Clearance Officer, Mail Stop C4-26-05, Baltimore, Maryland 21244-1850
State Executive Summary for Research Identifiable Data (02/14)

5