TO: State Health Officers  
State Medicaid Directors 
FROM: Administrator, Health Care Financing Administration  
Adminstrator, Health Resources and Services Administration  
Director, Centers for Disease Control and Prevention 
SUBJECT: Facilitating Collaborations for Data Sharing between State 
Medicaid and Health Agencies
HCFA, HRSA and CDC share common goals to assure access and improve quality of 
care provided to vulnerable populations. We have joined together to launch a 
coordinated strategy aimed at reducing barriers to sharing data between Medicaid 
and health agencies and supporting innovative approaches to the design and 
implementation of State information systems that foster collaboration among these 
programs. This commitment is formally embodied in an inter-agency agreement 
between HCFA and HRSA which will be implemented in partnership with CDC, and 
through collaboration with States. This letter provides information on the first set of 
activities we will conduct to support collaborations for data sharing between State 
Medicaid and health agencies. 
Model Data Sharing Agreement
The first activity described in the interagency agreement is the development and 
dissemination of a model data sharing agreement. This agreement provides a generic 
framework that includes all Federal confidentiality requirements and other 
restrictions on the use of information regarding Medicaid beneficiaries. HCFA has 
approved this model agreement for use by State Medicaid and health agencies as a 
tool for collaborations involving data sharing. We hope that this tool will help to 
standardize the process and clarify issues related to the appropriate and optimal 
uses of Medicaid data. HCFA can also provide States with standard data use 
agreements if access to national Medicaid and Medicare databases is necessary to 
support program design and improvement. 
Technical Assistance Activities
The interagency agreement also addresses coordinated technical assistance activities 
which we hope will support collaborations involving data sharing as well as 
innovative information systems designs. Our initial efforts will focus on three areas: 
  HCFA, HRSA and CDC will conduct an inventory of existing activities and 
models that we directly support and disseminate this information through a 
coordinated effort. This inventory will not duplicate other Federal and 
privately-sponsored efforts to collect information on these activities; rather 
we hope to complement and organize this information in a form that will be 
readily accessible to interested parties.     HRSA and CDC recently announced a new approach for States seeking greater 
flexibility in using categorical grant funding to plan and implement integrated 
public health information systems. The process is described in materials 
available on the CDC and HRSA Websites ( www.cdc.gov/funds/invest7.htm 
or www.hrsa.dhhs.gov/investment.htm) or by calling the contacts listed at the 
end of this letter. HCFA supports the direction articulated by HRSA and CDC 
because it will directly benefit State Medicaid agencies by coordinating public 
health information systems development and improve the value of data 
available through these systems. In addition, HCFA is developing new policies 
and guidelines on State Medicaid Management Information Systems (MMIS) 
that will recognize the new business environment of State Medicaid programs 
(including the benefits associated with coordination and integration with 
public health information systems) and complement the HRSA/CDC process.  
  The third element in this strategy will involve consultation with States and 
other interested parties regarding priorities for future Federal technical 
assistance activities. We will consult with the Association of State and 
Territorial Health Officials and National Association of State Medicaid 
Directors, and other organizations and individuals interested in facilitating the 
use of existing data sources to support Medicaid and health program design 
and implementation. In this context, we enclose information on various 
activities we are currently conducting that focus on improvement of 
immunization rates, particularly for children. We hope to refine and expand 
on these activities, and focus on additional areas based on the feedback we 
receive. Particular emphasis will be placed on assisting States in data 
collection and analysis necessary to meet specific goals established through 
the Government Performance Results Act.  
Contacts and Future Initiatives  
The interagency agreement, in conjunction with CDC, commits our agencies to 
coordinating Federal efforts that support State-level data sharing and information 
systems that will meet key population health assessment and improvement goals. 
The following individuals have been identified as the lead contacts to request 
information and conduct Federal coordination activities: 
HCFA:  
Stanley Nachimson, Technical Director  
Data and Systems Group  
Center for Medicaid and State Operations  
Phone: 410-786-6153  
E-mail: Snachimson@hcfa.gov 
HRSA:  
Mike Millman, Ph.D.  
Research Coordinator  
Office of Research, Policy and Legislation  
Phone: 301-443-0368  
E-mail: Mmillman@hrsa.dhhs.gov 
CDC:  
Raul Romaguera, DMD, MPH   Chief, Applied Sciences Branch  
Division of Public Health Surveillance and Informatics  
Epidemiology Program Office  
Phone: 404-639-0225  
E-mail: rar2@cdc.gov 
We will communicate with you on a regular basis to share updates on these activities 
and announce new initiatives designed to improve the quality and effectiveness of 
health care for vulnerable populations. You should contact any of the agency leads 
identified above to share ideas on how we can make this process work for you. 
___________________________  
Nancy-Ann DeParle  
Administrator, HCFA 
___________________________  
Claude Earl Fox, MD, MPH  
Adminstrator, HRSA 
___________________________  
Jeffrey P Kaplan, MD, MPH  
Director, CDC 
Attachments: 
HCFA/HRSA Interagency Agreement  
HCFA Model Medicaid Data Sharing Agreement  
Summary of Related Immunization Data Activities 
 
DATA SHARING AGREEMENT  
Background
Medicaid data is a key source for understanding the relationship between service 
delivery and improved outcomes for low income populations. For example, the 
characteristics of prenatal and maternity services from Medicaid payment records 
can be linked to background information on the mother's health and 
sociodemographic characteristics from birth/death records to better understand 
determinants of pregnancy outcomes. While there are tremendous benefits 
accompanying Medicaid data, section 1092 (a) (7) of the Social Security Act limits 
the use of individually identifiable Medicaid data to purposes directly connected to 
the administration of Medicaid. It is in this context that the purposes of data sharing 
as well as the benefits must be evaluated. 
The Health Care Financing Administration, in cooperation with the Health Resource 
Services Administration and the Centers for Disease Control and Prevention, have 
created a model data sharing agreement to guide the permissible sharing and  dissemination of Medicaid data among State Medicaid and Public Health agencies. 
Collaboration among these agencies could benefit from the use of Medicaid data to 
support policy initiatives as well as providing cogent analysis in the areas of public 
health surveillance, resource management and quality and performance measure 
which in turn will improve the administration of the Medicaid program and outcomes 
for the Medicaid population. 
Examples of benefits which can be derived from these cooperative efforts include: 
  Encouraging the development of integrated information systems at the State 
level to support the evolving role of State government in assuring 
appropriate, accessible, cost-effective care for vulnerable populations.  
  Improving the technical capacity of States to analyze data from multiple 
sources to support policy decision making and program monitoring.  
  Promoting the development and implementation of common performance 
measures across multiple programs to improve their effectiveness.  
  To better utilize Medicaid encounter data to assist in public health surveillance 
to ensure appropriate care for the Medicaid population.  
 
DEPARTMENT OF HEALTH/STATE MEDICAID AGENCY  
INTER-AGENCY  
DATA-SHARING AGREEMENT  
State of____________________ 
Requester 
Agency Name_____________________________________________________  
Data User________________________________________________________  
Title____________________________________________________________  
Address__________________________________________________________  
_________________________________________________________  
Phone____________________________________________________________ 
Data Provider 
Agency Name______________________________________________________  
Custodian_________________________________________________________  
Title_____________________________________________________________  
Address___________________________________________________________  
__________________________________________________________  
Phone_____________________________________________________________ 
I. PURPOSE
In this section, both parties must state in non-technical language the purpose(s) for 
which they are entering into the agreement, i.e., how the data will be used, what  studies will be performed, or what the desired outcomes are perceived to be as a 
result of obtaining the data. The source of the data will come from any and all public 
health or claims databases. The data will only be used for research and/or analytical 
purposes only and will not be used to determine eligibility or to make any other 
determinations affecting an individual. Furthermore, as the data will be shared within 
a State, it will be subjected to all applicable requirements regarding privacy and 
confidentiality that are described herein. 
III. PERIOD OF AGREEMENT
The period of agreement shall extend from________________________ to 
_____________________. 
IV. JUSTIFICATION FOR ACCESS
A. Federal requirements: Section 1902 (a) (7) of the Social Security Act (as 
amended) provides for safeguards which restrict the use or disclosure of information 
concerning Medicaid applicants and recipients to purposes directly connected with 
the administration of the State plan. Regulations at 42 CFR 431.302 specify the 
purposes directly related to State plan administration. These include (a) establishing 
eligibility; (b) determining the amount of medical assistance; providing services for 
recipients; and (d) conducting or assisting an investigation, prosecution, or civil or 
criminal proceeding related to the administration of the plan. 
 
If the State Medicaid agency is a party to this agreement, specifically as the provider 
of information being sought by the requestor, it must be demonstrated in this section 
how the disclosure of information meets the above requirements. 
An example of permissible data matching/sharing arrangements is the matching of 
data with a registry of vaccines or diseases for the purposes of improving outreach 
or expanding Medicaid coverage of populations being served under Medicaid. 
States should identify any additional requirements that are needed for the release of 
additional data in this section 
B. State requirements: Cite specific State statutes, regulations, or guidelines (See 
Appendices) 
V. DESCRIPTION OF DATA
In this section, the parties provide specific detailed information concerning the data 
to be shared or exchanged. 
VI. METHOD OF DATA ACCESS OR TRANSFER A description of the method of data access or transfer will be provided in this section. 
The requestor and its agents will establish specific safeguards to assure the 
confidentiality and security of individually identifiable records or record information. 
If encrypted identifiable information is transferred electronically through means such 
as the Internet, then said transmissions will be consistent with the rules and 
standards promulgated by Federal statutory requirements regarding the electronic 
transmission of identifiable information. 
VII. LOCATION OF MATCHED DATA AND CUSTODIAL RESPONSIBILITY
The parties mutually agree that one State agency will be designated as "Custodian" 
of the file(s) and will be responsible for the observance of all conditions for use and 
for establishment and maintenance of security agreements as specified in this 
agreement to prevent unauthorized use. Where and how the data will be stored and 
maintained will also be specified in this section. 
This agreement represents and warrants further that, except as specified in an 
attachment or except as authorized in writing, that such data shall not be disclosed, 
released, revealed, showed, sold, rented, leased, loaned or otherwise have access 
granted to the data covered by this agreement to any person. Access to the data 
covered by this agreement shall be limited to the minimum number of individuals 
necessary to achieve the purpose stated in this section and to those individuals on a 
need-to-know basis only. 
Note that, if all individually identifiable Medicaid data remains within the purview of 
the State Medicaid agency, matching with any other data is permissible. Any results 
of the data matching which contains individually identifiable data cannot be released 
outside the agency unless the release meets the conditions of Section IV. 
Any summary results, however, can be shared. Summary results are those items 
which cannot be used to identify any individual. It should be noted that the stripping 
of an individual's name or individual identification number does not preclude the 
identification of that individual, and therefore is not sufficient to protect the 
confidentiality of individual data. 
VIII. CONFIDENTIALITY
The User agrees to establish appropriate administrative, technical, and physical 
safeguards to protect the confidentiality of the data and to prevent unauthorized use 
or access to it. The safeguards shall provide a level and scope of security that is not 
less than the level and scope of security established by the Office of Management 
and Budget (OMB) in OMB Circular No. A-130, Appendix III -- Security of Federal 
Automated Information System, which sets forth guidelines for security plans for 
automated information systems in Federal agencies. 
Federal Privacy Act requirements will usually not apply if this agreement is entered 
into by agencies of the State and no Federal agencies are involved. The same applies  to the Computer Matching and Privacy Protection Act of 1988. However, State laws, 
regulations, and guidelines governing privacy and confidentiality will apply. 
It is strongly suggested that the guidelines presented in the Model State Vital 
Statistics Act be applied. The guidelines are available from the U.S. Department of 
Health and Human Services, Public Health Service, Centers for Disease Control and 
Prevention, National Center for Health Statistics, Hyattsville, Maryland (DHHS) 
Publication No. (PHS) 95-1115. 
Where States have enacted laws based on this model, the actual provisions of the 
statute take precedence. 
IX. DISPOSITION OF DATA
(Sample Language) 
The requestor and its agents will destroy all confidential information associated with 
actual records as soon as the purposes of the project have been accomplished and 
notify the providing agency to this effect in writing. Once the project is complete, the 
requester will: 
1.  Destroy all hard copies containing confidential data (e.g., shredding or 
burning)  
2.  Archive and store electronic data containing confidential information off line in 
a secure place, and delete all on line confidential data.  
3.  All other data will be erased or maintained in a secured area.  
X. DATA-SHARING PROJECT COSTS  
In this section, it should be stated in detail how the costs associated with the sharing 
or matching of data are to be met. If these can be absorbed by the "salaries and 
expenses," and the partner providing the requested data is agreeable to absorbing 
such costs, that should be noted here. If there are extra costs to be assumed, the 
parties need to specify here how they will be met. If the requesting party is to bear 
the burden of specific extra costs, or the party providing the data is unable or 
unwilling to bear such, these special requirements are to be formalized in this 
section. 
XI. RESOURCES
The types and number of personnel involved in the data sharing project, the level of 
effort required, as well as any other non-personnel resources and material, which are 
required, are to be listed here. 
XII. SIGNATURES In witness whereof, the Agencies' authorized representatives as designated by the 
Medicaid Director and Health Commissioner attest to and execute this agreement 
effective with this signing for the period set forth in Article III. 
(Name) (Name)  
______________________________ ______________________________ 
(Title) (Title) 
______________________________ ______________________________ 
(Date) (Date) 
______________________________ ______________________________ 
ATTACHMENT 3 - MEASURING CHILDHOOD IMMUNIZATION RATES: 
CURRENT FEDERAL INITIATIVES  
Immunization is an important marker for childhood health services. Research shows 
that promoting immunization helps to better serve the overall health needs of 
children. Children who fail to receive timely immunizations tend to utilize fewer other 
clinical preventive services such as screening for lead exposure, screening for 
anemia, and well child visits, placing them at higher risk of adverse outcomes from 
preventable diseases. Given the central importance of immunization as a marker of 
child health status, HCFA, HRSA and CDC have initiated coordinated efforts to 
improve systems that measure immunization status in order to promote increased 
immunization rates. The following is a brief description of these initiatives: 
The Health Care Financing Administration (HCFA) has developed a performance 
goal for FFY 2000 under the Government Performance and Results Act (GPRA), which 
will be conducted in partnership with State Medicaid agencies; 
  The goal is to measure the percentage of two-year old children enrolled in 
Medicaid by State who are fully immunized, and increases in this rate over 
time.  
  The HEDIS Childhood Immunization Measure, which estimates the percentage 
of children in an MCO who have received all of their appropriate 
immunizations by their second birthday, will be one data collection method 
used to evaluate this GPRA measure.  
The Maternal and Child Health Services Bureau (MCHB) of the Health 
Resources and Services Administration (HRSA)  
has also developed a GPRA measure, linked to Title V funding, that tracks childhood 
immunization rates; 
  HRSA is collaborating with the Centers for Disease Control and Prevention 
(CDC) to provide technical assistance to support State and local health 
department immunization programs.     MCHB's Application Guidance for the Maternal and Child Health Services Block 
Grant Program has been revise to include the Healthy People 2000 goals of 
having 90 percent of two-year olds fully immunized. Many States who have 
reached this goal will set higher targets as part of their MCH program 
activities.  
  Community and Migrant health centers are required by the Bureau of Primary 
Health Care to report immunization rates as a performance measure. State 
and Regional Primary Care Associations have established pilot projects to 
seek ways of improving review, audit and reporting processes.  
To address President Clinton's recent charge to Secretary Shalala to ensure that all 
children receive their proper series of vaccinations by age two, the Centers for 
Disease Control and Prevention (CDC) have been working to: 
  Implement immunization registries in every state that monitor the number of 
children who need immunizations, determines what series of vaccinations are 
needed, provides recall service to alert parents and providers to children who 
need vaccinations, and details the series of vaccinations given to each child.  
  Promote use of the Clinical Assessment Software Application (CASA), which is 
public domain software developed by the CDC to evaluate the immunizations 
rates and effectiveness within a state, city or county.  
  Implement refinements to the National Immunization Survey to improve 
tracking of low-income households and reported childhood immunization 
rates.