New CMS DUA Expiration Policy Meeting Facilit ator: S haron - PowerPoint PPT Presentation

New CMS DUA Expiration Policy Meeting Facilit ator: S haron Kavanagh, CMS Emmanuel S myrnoudis, CMS PLEAS E MUTE YOUR PHONES

Agenda  Why the change in policy  How it will effect users DUA(s)  How users Extend/ Close DUA(s)  Replacing Contacts on DUA(s)

CMS DUA Policies and Procedures CMS DUA policies and procedures may be found on our web site at: www.cms.gov/ Privacy

Policy Update Effective October 1, 2011 , t he Cent ers for Medicare & Medicaid S ervices (CMS ) policy for Dat a Use Agreement s (DUA) expirat ion dat es changed. CMS has det ermined t hat in response t o t he ever increasing cyber at t acks against comput er syst ems/ net works operat ed by t he Federal government as well as t he privat e sect or, CMS is refining and furt her rest rict ing our policy for t he ret ent ion of CMS dat a via a DUA.

CMS ’ New DUA Policy 1. All DUAs will have an expirat ion dat e, regardless of t he t ype of DUA, no except ions 2. All DUAs will have an init ial expirat ion dat e of no more t han 365 days from t he creat ion dat e 3. All DUAs must be revalidat ed annually by t he DUA Request or st at ing t hat t he dat a cont inues t o be needed for t heir Proj ect / S t udy as originally request ed 4. All DUA ext ensions will be grant ed for no more t han 365 days from t he current dat e 5. There will no longer be a maximum number of allowable ext ensions for a DUA as long as it em #3 above is validat ed annually 6. Current ly open DUAs t hat previously had an expirat ion dat e on or aft er Oct ober 2, 2012 have been assigned/ reassigned a new expirat ion dat e

How This Affects Y our DUA  To meet t he requirement s in t he policy, many DUAs have been assigned new DUA expirat ion dat es.  All requestors and custodians are being notified of their DUA ’s new expiration date.  Request ors and cust odians will have t o manage t heir DUA expirat ion dat es and request ext ensions or closures of t heir DUAs appropriat ely  Extensions should be requested no later than 60 – 90 days prior to the expiration date on the DUA  Email notices will go out to requestors and custodians 90 days, 60 days, 30 days and then every day thereafter prior to the expiration date on the DUA.

Extending a CMS DUA: Extension Justification S tatement  S end To Dat aUseAgreement @ cms.hhs.gov  S ubj ect line: DUA ##### - Ext ension Request “ We are current ly st ill using t his dat a as originally request ed for our Proj ect / S t udy. We underst and t hat t he dat a in t his DUA may not be used in any form for any addit ional work out side t he scope of t his DUA wit hout t he expressed writ t en consent of CMS ’ Privacy S t aff. We request a one (1) year [or less if applicable] ext ension for t his DUA.”  Do not include Addendum changes in ext ension request emails 

E-Mail Extension Example

Closing your CMS DUA  Dat a users complet e t he CMS DUA Cert ificat e of Dest ruct ion form using t he link found on t he following on our web sit e at :  www.cms.gov/ Privacy  In t he "CMS Dat a Files Dest royed" sect ion, t he file(s) being dest royed must be list ed exact ly as t hey are list ed for your DUA in our Dat abase. Refer t o your most recent .ht m file for your DUA t hat you received from t he CMS DUA Team or t he expirat ion not ice e-mail t hat you recent ly received for t he DUA from CMS for a complet e list ing of t he dat a files cont ained in t he DUA.  Aft er complet ing t he form; print , sign, scan and send as an e- mail at t achment t o DataUseAgreement@cms.hhs.gov Place in t he subj ect line DUA ##### - Closure Request  The CMS DUA Team will send you an e-mail confirming t he closure of your DUA.

CMS DUA Requestor/ Custodian Changes  To replace a Request or or add a Cust odian t o a DUA, complet e t he CMS Dat a Use Agreement (DUA) Addendum on our web sit e.  www.cms.gov/ Privacy  After completing the form, print, sign, scan and send as an e-mail attachment to DataUseAgreement@ cms.hhs.gov  To remove a Cust odian from a DUA, send an e-mail t o DataUseAgreement@ cms.hhs.gov and st at e explicit ly which individual(s) should be removed from which DUA.

Timeframe for DUA Team to complete your request Note: Following the release of new data sets (e.g. Limited Data S et [LDS ] files or Disproportionate S hare [DS H] data), additional time may be required due to the increased volume of requests.  Current DUA Extensions & Closures 1-5 business days  Current DUA Requestor & Custodian changes 1-5 business days  Oversight Agencies 1-5 business days  Disproportionate S hare Hospital (DS H) 3-5 business days  CMS Contracts 10-14 business days  Limited Data S ets (LDS ) 6-8 weeks

Questions? ? ? ? www.cms.gov/ Privacy DataUseAgreement@ cms.hhs.gov