CMS-R-235 DUA Supporting_Statement -- feedback 2020-05-05 5-7-20 clean

Supporting Statement for Paperwork Reduction Act Submissions

Data Use Agreement (DUA) Form (CMS R-235; OMB 0938-0734)

1. Background

The Privacy Act of 1974, §552a requires the Centers for Medicare & Medicaid Services (CMS) to track all disclosures of the agency’s Personally Identifiable Information (PII). CMS is also required by the Health Insurance Portability and Accountability Act (HIPAA) of 1996 and the Federal Information Security Management Act (FISMA) of 2002 to properly protect all PHI data maintained by the agency and account for the disclosure of PHI. When entities, such as academic, federal or state agency researchers or CMS contractors request CMS PII/PHI data, they enter into a Data Use Agreement (DUA) with CMS. The DUA stipulates that the recipient of CMS data must properly protect the data according to all applicable data security standards and also provide for its appropriate destruction at the completion of the project/study or the expiration date of the DUA. The DUA form enables the data recipient and CMS to document the request and approval for release of CMS data. The form requires the submitter to provide the Requestor’s organization; project/study name; CMS contract number (if applicable); data descriptions and the years of the data; retention date; attachments to the agreement; name, title, contact information to include address, city, state, zip code, phone, e- mail, signature and date signed by the requester and custodian; disclosure provision; name of Federal Agency sponsor; Federal Representative name, title, contact information, signature, date; CMS representative name, title, contact information, signature and date; and concurrence/non-concurrence signatures and dates from 3 CMS System Managers or Business Owners.

This request to OMB is to reinstate the previously approved collection CMS R-235. The collection entered a state of violation due to administrative issues.

We updated burden estimates in section 12. Since this estimates the respondents’ costs, we used the BLS rather than the GS schedule for the wage estimates. In addition, recent experience has shown that the time to complete an LDS DUA has slightly increased. Also, two of the forms that were initially included in this package are no longer used.

2. Justification

1 . Need and Legal Basis

The Privacy Act of 1974 allows for discretionary releases of data maintained in Privacy Act protected systems of records under §552a(b) (Conditions of Disclosure). The mandate to

account for disclosures of data under the Privacy Act is found at §552a(c)(Accounting of Certain Disclosures). This section states that certain information must be maintained regarding disclosures made by each agency. This information is: Date, Nature, Purpose, and Name/Address of Recipient. Section 552a(e) sets the overall Agency Requirements that each agency must meet in order to maintain records under the Privacy Act. The Data Use Agreement (DUA) form is needed as part of the review of each CMS data request to ensure compliance with the requirements of the Privacy Act for disclosures that contain PII. The DUA form also provides data requestors and custodians with a formal means to agree to the data protection and destruction statutory and regulatory requirements of CMS’ PII data. The Health Insurance Portability and Accountability Act (HIPAA) of 1996, §1173(d) (Security Standards for Health Information) requires CMS to protect Protected Health Information (PHI). Additionally, Federal Information Security Management Act (FISMA), 44 U.S.C. § 3541-3549, as amended by the Federal Information Security Modernization Act of 2014 (Pub.

L. 113-283) also requires CMS to develop policies and procedures for the protection and destruction of sensitive data to include PII.

2. Information Users

The information collected by the DUA form is used by CMS to track disclosures, conditions for disclosure, accounting of disclosures and agency requirements dictated by the Privacy Act, HIPAA and FISMA.

2. Use of Information Technology

The DUA form may be filled in on-line and then must be printed and signed. The signed form may be submitted to CMS as a scanned document (e.g. .pdf, .jpg, .tif) attached to an e- mail. It is estimated that all DUA forms will be submitted to CMS via e-mail attachment.

CMS is beginning to explore the use of digital signatures on the forms.

2. Duplication of Efforts

This information collection does not duplicate any other effort and the information cannot be obtained from any other source

2. Small Businesses

No special considerations are given to small businesses; however, the burden to any User/Requestor of data is minimal.

2. Less Frequent Collection

Data is collected only once at the onset of the study/project and then only again if there are changes initiated by the Requestor. There are no additional means for reducing the data collection burden and still be compliant with all applicable statutory and regulatory requirements, as well as CMS policies/procedures.

2. Special Circumstances

No special circumstances.

2. Federal Register/Outside Consultation

The 60-day Federal Register notice published to the Federal Register (84 FR 30123) 06/26/2019.

The collection received zero comments

The 30-day Federal Register notice published to the Federal Register (84 FR 63657) 11/18/2019.

2. Payments/Gifts to Respondents

There were no payments/gifts provided to respondents for their participation or usage of the form. The DUA form is used to help CMS track disclosures, conditions for disclosure, accounting of disclosures and agency requirements.

2. Confidentiality

The files are maintained electronically in the Enterprise Privacy Policy Engine.

2. Sensitive Questions

There are no sensitive questions arising from this data collection.

2. Burden Estimates (Hours & Wages)

Wages

To derive average costs, we used data from the U.S. Bureau of Labor Statistics’ May 2018 National Occupational Employment and Wage Estimates for all salary estimates (http://www.bls.gov/oes/current/oes_nat.htm). In this regard, the following table presents the mean hourly wage, the cost of fringe benefits and overhead (calculated at 100 percent of salary), and the adjusted hourly wage.

Occupation Titles and Wage Rates*

Occupation Title	Occupation Code	Mean Hourly Wage($/hr)*	Fringe Benefit ($/hr)	Adjusted Hourly Wage($/hr)
Business Operations Specialist	13-1000	35.52	35.52	71.04

As indicated, we are adjusting our employee hourly wage estimates by a factor of 100 percent. This is necessarily a rough adjustment, both because fringe benefits and overhead costs vary significantly from employer to employer, and because methods of estimating these costs vary widely from study to study. We believe that doubling the hourly wage to estimate total cost is a reasonably accurate estimation method.

Requirements and Associated Burden

1. Form 0235 DUA - We estimate the time to complete the DUA form is 30 minutes per requestor. We estimate that it will take 25 minutes to complete and submit the form and an additional 5 minutes for filing. On an annual basis, we expect to receive an average of 3,600 DUA forms for an annual total of 1,800 hours burden for a total annual cost burden of $127,872.

2. Form 0235l Limited Data Set (LDS) DUA – We estimate the time to complete the LDS DUA is 30 minutes per requestor. We estimate that it will take 25 minutes to complete and submit the form and an additional 5 minutes for filing. On an annual basis, we expect to receive an average of 600 LDS DUAs for an annual total of 300 hours burden for a total cost burden of $21,312.

3. Form 0235a Addendum - We estimate the time to complete the Addendum form is 10 minutes per requestor. We estimate that it will take 5 minutes to complete and submit the form and an additional 5 minutes for filing. On an annual basis, we expect to receive an average of 4,000 Addendums for an annual total of 640 hours burden for a total cost burden of $45,465.

4. Form 0235u Update DUA – We estimate the time to complete the Update DUA is 10 minutes per requestor. We estimate that it will take 5 minutes to complete and submit the form and an additional 5 minutes for filing. On an annual basis, we expect to receive an average of 1,000 Update DUAs for an annual total of 160 hours burden for a total cost burden of $11,366.

Burden Summary

Summary	No. Respond ents	Response s (per Responde nt)	Total Response s	Time (per response) (hours)	Total time (hours) *	Labor Rate ($/hr)	Total Cost ($)
Form 0235 DUA	3,600	1	3,600	.5	1,800	71.04	127,872
Form 0235l Limited Data Set (LDS) DUA	600	1	600	.5	300	71.04	21,312
Form 0235a Addendum	4,000	1	4,000	.16	640	71.04	45,465
Form 0235u Update DUA	1,000	1	1,000	.16	160	71.04	11,366
Total	9,200	--	9,200	1.32	2,900	71.04	206,015

2. Capital Costs

There are no capital costs.

2. Cost to Federal Government

To derive average costs, we used the General Schedule (GS) 13 step 5 pay scale with locality pay adjustment for the Washington/Baltimore/Northern Virginian (https://www.opm.gov/policy-data- oversight/pay-leave/salaries-wages/salary-tables/pdf/2019/DCB.pdf). In this regard, the following table presents the mean hourly wage, the cost of fringe benefits (calculated at 100 percent of salary), and the adjusted hourly wage.

Occupation Titles and Wage Rates

Occupation Title	Mean Hourly Wage($/hr)*	Fringe Benefit ($/hr)	Adjusted Hourly Wage($/hr)
GS-13 (step 5)	52.83	52.83	105.66

1. Form 0235 DUA - We estimate the time to review and process the DUA form is 25 minutes per request. On an annual basis, we expect to receive an average of 3,600 DUA forms for an annual total of 1,512 hours burden for a total annual cost burden of

$159,758.

2. Form 0235l Limited Data Set (LDS) DUA – We estimate the time to review and process the LDS DUA is 10 minutes per request. On an annual basis, we expect to receive an average of 600 LDS DUAs for an annual total of 96 hours burden for a total cost burden of $10,143.

3. Form 0235a Addendum - We estimate the time to review and process the Addendum form is 10 minutes per request. On an annual basis, we expect to receive an average of 4,000 Addendums for an annual total of 640 hours burden for a total cost burden of

$67,622.

4. Form 0235u Update DUA – We estimate the time to review and process the Update DUA is 10 minutes per request. On an annual basis, we expect to receive an average of 1,000 Update DUAs for an annual total of 160 hours burden for a total cost burden of $16,906.

Summary	No. Respond ents	Response s (per Responde nt)	Total Response s	Time (per response) (hours)	Total time (hours) *	Labor Rate ($/hr)	Total Cost ($)
Form 0235 DUA	3,600	1	3,600	.42	1,512	105.66	159,758
Form 0235l Limited Data Set (LDS) DUA	600	1	600	.16	96	105.66	10,143
Form 0235a Addendum	4,000	1	4,000	.16	640	105.66	67,622
Form 0235u Update DUA	1,000	1	1,000	.16	160	105.66	16,906
Total	9,200	--	9,200	.90	2,408	105.66	254,429

2. Changes to Burden

The change in burden reflects the use of BLS estimates for hourly wages for DUA requestors instead of the GS scale for federal employees. In addition, the hourly wages estimated for both the DUA requestors and the Government employees include fringe and benefits. We also removed the Medicaid Agency DUA form and the state DUA form since they are no longer in use. We also slightly increased the estimate to complete an LDS DUA based on feedback from requestors.

2. Publication/Tabulation Dates

There are no publication and tabulation dates associated with this collection.

2. Expiration Date

This expiration date will be displayed on all documents once it becomes available.

2. Certification Statement

There are no exceptions to the certification statement.

1