Data Disclosure and Use Restrictions

(1) Required Assurances. All applicants shall make the following written assurances in order to receive Health Care Claims Data from the Council: (a) The applicant, his/her employees, and his/her agents or contractors shall use the Health Care Claims Data only for the purpose stated in the request. (b) The applicant shall limit access to the Health Care Claims Data to authorized employees, agents, or contractors as are reasonably necessary to undertake the permitted data uses, and shall ensure that all such employees, agents, and contractors with access to the data comply with all data privacy and security protections and data use restrictions, prohibitions and protections set forth in 129 CMR 3.00 and in the Data Use Agreement with the Council. To that end, the applicant shall obtain the written assurances of any authorized agent or contractor to comply with data privacy and security protections and data use restrictions, prohibitions and protections set forth in 129 CMR 3.00 and in the Data Use Agreement, including reporting to the applicant any use or disclosure of Health Care Claims Data that is not provided for in the Data Use Agreement. (c) The applicant, his/her employees, and his/her agents or contractors shall not use the Health Care Claims Data, alone or in combination with any other data, to identify individual patients, clinicians or payment rates, nor will the applicant, his/her employees, and his/her agents or contractors attempt to identify individual patients, clinicians, or payment rates from the data, or to contact individual patients or clinicians. (d) The applicant, his/her employees, and his/her agents or contractors shall not use the Health Care Claims Data, alone or in combination with any other data, in ways that enable or permit collusion or anti-competitive conduct. (e) The applicant, his/her employees, and his/her agents or contractors shall not sell the Health Care Claims Data, nor use the data for any marketing or commercial purposes. (f) The applicant, his/her employees, and his/her agents or contractors shall retain the requested Health Care Claims Data only as long as is necessary to accomplish the applicant's intended use or purpose. The applicant, his/her employees, and his/her agents or contractors shall return to the Councilor destroy, in the Board's discretion, all such data, including any copies of the data, as soon as he/she has accomplished that purpose or use. The Board may limit the amount of time within which an applicant may retain data. (g) The applicant, his/her employees, and his/her agents or contractors shall not reuse, manipulate, or re-aggregate Health Care Claims Data for purposes other than those approved by the Board. (h) The applicant shall immediately report to the Board any use or disclosure of Health Care Claims Data that is not provided for in the Data Use Agreement and shall immediately attempt to retrieve such data and take other appropriate actions to limit the known harmful consequences of the non- permitted use of disclosure. (i) The applicant, his/her employees, and his/her agents shall permit the Council, its employees, and its designated agents to audit the applicant's compliance with the requirements of the Data Use Agreement at any time. The applicant shall provide any other assurances required by the Data Use Agreement. (2) Publication. An applicant shall not publish or otherwise disclose any Level 1, Level 2 or Level 3 Data Elements, or any data derived or extracted from such data, in any paper, report, website, statistical tabulation, or similar document unless such paper, report, website, statistical tabulation, or similar document without prior review and approval of the Board. An Applicant must submit a copy of the proposed report or document to the Board for approval at a scheduled Board meeting at least 14 days before the meeting. The report must conform to the standards for de-identification set forth under 45 CFR 165.514(a), (b)(2), and (c). An applicant's public paper, report, website, statistical tabulation, or similar document may not contain individual payment rates, report any data on ten or fewer individuals or data derived from ten or fewer claims, or include any other matter that the Board has precluded for release in the Data Use Agreement.