• Application for Standard Analytic Files from the Maryland Medical Care Data Base (Governmental Entity)

    Application for Standard Analytic Files from the Maryland Medical Care Data Base (Governmental Entity)

  • Application Received
     - -
  • Application Approved
     - -
  • Data Obtained
     - -

  • INSTRUCTIONS

    This form is required for Governmental Entity Applicants requesting Standard Analytic Extracts. Applicants must complete all of the attachments. The completed Application and the Data Management Plan will be used by MHCC to determine whether the request meets the criteria for data release, pursuant to COMAR 10.25.05. Incomplete applications will be returned to the Applicant and the request will be delayed. All applications must include evidence that the project has been reviewed by the governmental entity's legal counsel regarding the entity's legal authority to use the data requested for the purpose described.

  • Note to Applicants:

    • Review data availability here and here
    • All application attachments will be incorporated into the Data Use Agreement (DUA) that will need to be signed prior to any Maryland APCD data being transmitted. A draft DUA will be provided to the applicant after this Application is received, so that the applicant can review the terms and conditions. 

    Questions?

    Email mhcc.datarelease@maryland.gov

  • Data Fee Calculator available to estimate the fee for your data sets. 

  • TABLE OF CONTENTS

  • INSTRUCTIONS

    1

    PROJECT INFORMATION

    3

    ATTACHMENT A: SCOPE OF WORK

    4

    ATTACHMENT B: MCDB DATASET REQUESTED

    7

    ATTACHMENT C: ADDITIONAL DATA SOURCES AND LINKAGE

    8

    ATTACHMENT D: DATA MANAGEMENT PLAN

    10

    ATTACHMENT E: USE OF CONTRACTORS AND/OR CONSULTANTS (External Entities)

    15

    ATTACHMENT F: APPLICANT QUALIFICATIONS 

    16

    ATTACHMENT G: ATTESTATION

    17

  • PROJECT INFORMATION

  • Project Title
    Scheduled Project Start Date   Pick a Date   
    Scheduled Project End Date   Pick a Date   

  • 0/150

  • Applicant (Governmental Entity)
    Organization Name            
    Website      
    Email Address      
    Telephone Number           
    Mailing Address                  

  • Principal Investigator/Project Manager (individual responsible for the research team using the data)
    Name            
    Title           
    Email Address      
    Telephone Number         
    Organization Name      
    Mailing Address                  

  • Data Custodian (person responsible for receiving, organizing, storing, and archiving data)
    Name           
    Title     
    Email Address      
    Telephone Number         
    Organization Company (if different from Applicant)   
    Mailing Address                  
    Relationship to Applicant (e.g., Contractor)      

  • Project Contact (person responsible for all communications with MHCC)
    Name           
    Title     
    Email Address      
    Telephone Number         
    Organization Name    
    Mailing Address                 

  • ATTACHMENT A: SCOPE OF WORK

  • 1. Project Purpose

  • 2. Project Methodology

  • 3. Publication and Dissemination

    Briefly (1-3 sentences) explain any "Yes" answer.

  • a. Do you anticipate that the results of your analysis will be published or made publicly available?

  • b. If you answer "yes" to any of the following questions, describe the types of products, software, services, or tools and the corresponding fees will be for such products, software, services, or tools. 

  • i. Will the MD APCD data be used for consulting purposes?
  • ii. Will report(s), website(s) or a statistical tabulation(s) using MD APCD data be shared or sold?
  • iii. Will a software product using MD APCD data be shared or sold?
  • iv. Will MD APCD data be used as input to develop a product (i.e., severity index tool, risk adjustment tool, a reference tool, etc.)?
  • v. Will MD APCD data be sold or shared in any format not noted above?
  • vi. Will the project result in disclosing MD APCD data, or any data derived or extracted from such data, in any paper, report, website, a statistical tabulation, seminar, or another setting that is not disseminated to the public?
  • vii. Will the results from the project be used for price transparency?
  • viii. Will health care providers be individually identified?

  • ATTACHMENT B: MD APCD DATASET REQUESTED

  • MHCC collects privately insured data (claims and membership), known as the Medical Care Data Base (MCDB), on a quarterly basis from life and health insurance carriers, health maintenance organizations (HMOs), third party administrators (TPAs), and pharmacy benefits managers (PBMs) that are licensed to do business in Maryland. The MCDB is Maryland's APCD. The MCDB data that is available for release contains eligibility and professional, institutional, and pharmacy claims. Starting in 2015, the Medical Care Data Base (MCDB) excludes private plan data for self-insured ERISA plans due to the Gobeille v. Liberty Mutual Supreme Court ruling.

    The data which is refreshed and updated annually contains only privately fully-insured and self-insured non-ERISA health insurance plans for Maryland and non-Maryland residents. The MCDB encompasses about 90-95% of the privately fully insured market in Maryland and 25%-30% of the self-insured market (post-Gobeille, primarily non-ERISA). To determine the years for which data are available please check on the MHCC website. That site also contains information about the most current MCDB Release Version and a full list of elements in the release including the release record layouts, data dictionaries, and supporting documentation here.

  • Institutional Claims
  • Professional Claims
  • Pharmacy Claims
  • Member Eligibility

  • ATTACHMENT C: ADDITIONAL DATA SOURCES AND LINKAGE

  • 1. Maryland Medicaid Data

    Applications for access to Medicaid Managed Care data for studies comparing the privately insured to Medicaid Managed Care patients can be submitted but require a separate approval from the Maryland Medicaid Administration. The fields available on the Medicaid MCO data sets have been aligned with MD APCD fields to the extent possible.

  • a. Indicate whether you are seeking Medicaid data:
  • b. Do you intend to merge or link MD APCD data with Medicaid data?

  • 2. Medicare Data

    If requesting Medicare data, the request is reviewed in accordance with the State Agency DUA and CMS State Data Request Memo. 

    Privacy Board Approval: As required by HIPAA, all data disclosures for research must be approved by the Privacy Board. For the Privacy Board to approve any data release, it must conclude that several criteria laid out at 45 CFR 164.512(i)(2)(ii) are met. Specifically the requesting agency must provide: 

  • 3. Other Linkages

    Data linkage involves combining MD APCD data with other data to create a more extensive database for analysis. 

  • 1. Do you intend to merge or link MD APCD Data with other data? If Yes, please complete questions a-e that follow.

  • ATTACHMENT D: DATA MANAGEMENT PLAN

  • Certification

    The undersigned certifies and agrees as follows:

    • The data will be used only for approved purposes of analysis and presentation.
    • The Requesting Organization will comply with all administrative, technical, and procedural policies and physical safeguards established to protect the confidentiality of the data and to prevent unauthorized access to the data.
    • The data will be encrypted at rest and in motion on storage media (backup tapes, local hard drives, network storage, et al.) with at least an AES-256 standard or stronger.
    • The Requesting Organization understands and agrees that any intentional breach of confidentiality will result in termination of the Data Use Agreement. 
    • Anti-virus software or service is active on any server or endpoint containing the MD APCD data.
    • Staff with access to PHI or other sensitive data have received all relevant training. 

    The Requesting Organization has policies and procedures in place to address:

    • The sharing, transmission, and distribution of PHI
    • The physical possession and storage of PHI
    • The destruction of PHI upon completion of data use
    • Confidentiality agreements with each individual, including contractors, who will access PHI
    • Agreements governing the use and disclosure of PHI with all non-employees who will access PHI

  • 1. Responsible Individuals

  • a. Provide the name(s) of the custodian responsible for receiving, organizing, storing, or archiving the data.
    Name       
    Title      
    Email Address      
    Telephone Number         
    Organization Name      
    Mailing Address                  

  • b. Provide the name of the person who will notify MHCC of any breach of the MD APCD data, Data Use Agreement, or the Data Management Plan
    Name       
    Title      
    Email Address      
    Telephone Number         
    Organization Name      
    Mailing Address                  

  • c. Provide the name of the person responsible for ensuring proper data destruction upon the termination of the Data Use Agreement, and submission of the Certification of Data Destruction.
    Name       
    Title      
    Email Address      
    Telephone Number         
    Organization Name      
    Mailing Address                  

  • d. Provide the name of the person who will notify MHCC of any project staffing changes, maintain the roster of staff who have formal, documented permission to access specific files for specific purposes, and ensure that all individuals with access to the data comply with the Data Use Agreement.
    Name       
    Title      
    Email Address      
    Telephone Number         
    Organization Name      
    Mailing Address                  

  • 2. Physical Possession and Storage of Data Files

  • 1. Where will the data be stored?

  • 2. Provide the delivery address for the data, including the location where the data will be stored.
    i. Delivery Address 
                     
    ii. Storage Address
                   

  • 3. Provide the name and address of the Cloud Service Provider
    Name   
    Cloud Service Provider Address 
               

  • 4. Describe the name and data security assessment level of each physical location and the Cloud Service Provider where the data will be stored. Provide evidence that the proposed computing environment meets or exceeds NIST 800-53v4 security standards. Identify all certifications held by entities that will store or hold data.

    1. SOC 2 Type Audit 
    2. HITRUST Certification
    3. ISO 27001 Audit Certification
    4. Independent external HIPAA standards Assessment
    5. SSAE 16 Overview, and/or
    6. FedRAMP Certification
  • 5. Has each individual who will access the data agreed to the Requesting Organization's privacy and security rules when using MD APCD data files?
  • 6. Within the last 12 months, has each individual who will access MD APCD data received training on the proper handling of protected health information and/or personal data?

  • 3. Data Sharing, Electronic Transmission, and Distribution

  • For data stored on a network drive and not on your computer hard drive:
  • For data stored on the local hard drive of a computer:

  • 4. Describe the Applicant's technical safeguards preventing unauthorized access to MD APCD data files.

  • 5. If applicable, describe the Applicant's physical safeguards preventing unauthorized access and check all security features listed below that are present in the room containing MD APCD data files:
  • 6. If applicable, identify the data transmission method(s) you plan to use.

  • 4. Completion of Research Tasks and Data Destruction

    Applicant must agree that the MD APCD data, all copies and backups must be destroyed immediately after the period of time necessary to fulfill the requirements of the data request in accordance with the terms and conditions of the Data Use Agreement. All data destruction must follow and conform to NIST Special Publications 800-88. Guidelines for Media Sanitization.

  • ATTACHMENT E: USE OF CONTRACTORS AND/OR CONSULTANTS

    (External Entities)

  • Provide the following information for all consultants and contractors who will have access to the MD APCD data. The Applicant must have a written agreement with the contractor/consultant to ensure the use of MD APCD data only for the approved project(s) of this application as well as the privacy and security standards set forth in the Data Use Agreement. MD APCD data may not be shared with any third party without prior written consent from MHCC, or an amendment to this Application.

  • Entity               
    Contractor/Subcontractor/Consultants Name      
    Title      
    Website      
    Contact Person         
    Email Address      
    Telephone Number         
    Mailing Address                  
    Term of Contract      

  • 4. Will this entity have access to or store the MD APCD data at a location other than the data custodian location, off-site server, and/or database?

  • If yes, a separate Data Management Plan must be completed by this contractor/consultant. 

  • ATTACHMENT F: APPLICANT QUALIFICATIONS

  • Browse Files
    Drag and drop files here
    Choose a file
    Cancelof

  • ATTACHMENT G: ATTESTATION

  • ATTESTATION OF GOVERNMENTAL ENTITY AGENCY HEAD OR CHIEF EXECUTIVE OFFICER

    I,         ,      , of      , the Applicant in this Application, have been duly authorized by the Applicant to execute this attestation on its behalf. I solemnly affirm under penalties of perjury that the information contained in the Application, its attachments, and this Attestation, is true and correct to the best of my knowledge, information, and belief.

  • Signature of authorized representative of Applicant
       *   
    Printed Name   *   *   
    Title   *    
    Date   Pick a Date*   

  • ATTESTATION OF LEGAL COUNSEL FOR REQUESTING GOVERNMENTAL ENTITY

    I,         ,      , of      , the Applicant in this Application, solemnly affirm that the Applicant has legal authority to use the requested data for the purposes described herein.


    Signature of legal counsel of the Requesting Governmental Entity
       
    Printed Name         
    Title      
    Date   Pick a Date   

  • When you submit this application, a draft DUA will be produced for your review of the terms and conditions. There is no action needed on the DUA at this time. If your application is approved, MHCC will send you a final formal DUA for execution.

  •  
  • Should be Empty: