DEPARTMENT OF HEALTH & HUMAN SERVICES 
Centers for Medicare & Medicaid Services 
7500 Security Boulevard, Mail Stop S2-26-12 
Baltimore, Maryland 21244-1850 
 
Center for Medicaid and State Operations 
 
                    SMDL #02-011 
              June 4, 2002 
 
Dear State Medicaid Director: 
 
The purpose of this letter is to provide you with updated information about new procedures for 
requesting retrospective Medicare claims from Medicare's National Claims History (NCH) 
Standard Analytical Files (SAF) files for your State.  You will continue to receive crossover 
claims from the Medicare contractors according to the terms of your partnership agreements with 
them.  This letter replaces the State Medicaid Director (SMD) letter, dated June 21, 2000, 
regarding access to the Adjudicated Claims File (ACF) directly from Medicare's Fiscal 
Intermediaries (FIs) and Carriers.  
 
As of May 31, 2002, Medicare contractors will no longer provide ad-hoc retrospective claims to 
you.  This change is being made because these requests require special software that is not part 
of the core business of the Medicare contractors, which is to adjudicate current Medicare bills.  
Instead, you may access Medicare claims files for adjusted, denied and paid claims for your 
dually eligible population directly from the Centers for Medicare and Medicaid Services (CMS) 
on a one time basis.  
 
In order to ensure that states may access all the Medicare data they need to effectively and 
efficiently administer the Medicaid program for their dually eligible beneficiaries, we will 
provide those states that need it, up to 36 months of retrospective claims (see Enclosures A and 
D for more detail) to facilitate the coordination of benefits (COB) between the Medicare and 
Medicaid Programs.  Also, to ensure that you have complete current data from crossover files, 
the state should request all Part A, Part B, durable medical equipment (DME), and regional home 
health intermediary (RHHI) claims as part of the selection criteria in your Trading Partner 
Agreements (TPA).  
 
In addition, we strongly urge that those states which have not done so to review our SMD letter 
of January 9, 2002, which outlines procedures for submitting finder files to produce a more 
complete and accurate matching of Medicaid beneficiary files with Medicare's Enrollment 
Database (EDB).  Following these procedures (beginning with entering into a data use agreement 
(DUA) with CMS) will result in states having current and complete "matches" for identifying 
their dual eligible population.  These "matched" eligibles can then constitute a finder file 
including Medicare Health Insurance Claim Numbers (HICs), which can be submitted to CMS 
for retrospective claims data.   
 
In an effort to conserve expensive CMS data systems resources, a state should only select those 
bill types that were not received through a retrospective claims request in the recent past.   Page 2  State Medicaid Director  
 
Additionally, if a state Medicaid agency receives a specified retrospective claim file from CMS, 
CMS will not send duplicate copies of the same file to another state agency or entity requesting it  
on behalf of the state.  Rather, the state Medicaid agency should request (via a DUA) that the 
data provided to them by CMS be used for another allowable purpose (e.g., provided to the 
Attorney Generals office for fraud and abuse purposes). 
 
With the more accurate and complete set of identified dual eligibles in their state, States will 
have established finder files that can be submitted to contractors on a current basis, making 
subsequent requests for retrospective claims histories unnecessary for COB.  This process does 
not, however, preclude you from making special requests for Medicare data under separate 
DUAs (e.g., special requests for Medicare data from non-duals for comparison or research 
purposes, or for Medicare data that is older than 3 years). 
                     
To ensure that you are receiving all of the crossover claims data you need, you should evaluate 
existing TPAs and if needed, pursue new or revised TPAs with appropriate Medicare contractors.   
We would also note that by utilizing TPA's to receive prospective, current Medicare claims 
through the crossover process, as well as the one-time, CMS direct approach to receive 
retrospective Medicare claims, you are provided with accurate and complete data on your dually 
eligible beneficiary population's medical experience, as well as a historical perspective on past 
experiences.  The materials needed to participate in this improved dually eligible retrospective 
claims extraction process include: 
 
  Updated NCH File Process and Steps for States to take  (Enclosure A). 
 
  An updated DUA template (Enclosure B) for retrospective file requests, which is returned 
to CMS for approval.  The enclosed package includes instructions for preparation of a 
DUA (Enclosure C); 
  
  The record specifications for state finder file as well as the available NCH SAF Files 
(Enclosure D); and  
 
If you have any questions about any aspect of this process, please direct them to Rebecca 
(Goldy) Rogers at (410) 786-6450 or rrogers1@cms.hhs.gov, or Cheryl Sample at  
(410) 786-7185 or csample@cms.hhs.gov.  
 
 
 
          Sincerely, 
 
          /s/ 
 
Dennis G. Smith 
          Director 
Enclosures   
Page 3  State Medicaid Director 
 
cc:   
 
CMS Regional Administrators 
 
CMS Associate Regional Administrator 
  for Medicaid and State Operations 
 
CMS Associate Regional Administrator 
  for Medicare 
 
Lee Partridge 
Director, Health Policy Unit 
American Public Human Services Association 
 
Joy Wilson 
Director, Health Committee 
National Conference of State Legislatures 
 
Matt Salo 
Director of Health Legislation 
National Governors Association 
 
Brent Ewig 
Senior Director Access Policy 
Association of State and Territorial Health Officials 
 
Jim Frogue 
Acting Director, Health and Human Services Task Force 
American Legislative Exchange Council 
 
Trudi Matthews 
Senior Health Policy Analyst 
Council of State Governments 
 
Ned Burford, OIS 
 
Robyn Thomas, OIS 
 
Geraldine Nicholson, CMM 
   
ENCLOSURE A 
Medicare National Claims History Standard Analytical File  
DATA REQUEST  
STEPS TO FOLLOW FOR A NEW REQUEST OR A REUSE REQUEST 
 
 
NEW DATA REQUEST 
 
1.  On a one-time only basis, each state should submit a request letter with a detailed 
justification for the data and the original signed Data Use Agreement (DUA) to the 
Centers for Medicare and Medicaid Services (CMS). See the attached DUA with 
instructions. This package should be submitted to: 
 
Rebecca (Goldy) Rogers  
Centers for Medicare & Medicaid Services 
Center for Medicaid & State Operations 
Mailstop:S3-13-15 
7500 Security Blvd. 
Baltimore, MD 21244-1850 
Phone: (410) 786-6450 
E-Mail: rrogers1@cms.hhs.gov 
 
If another agency within your state has received claims data for the prior three years, 
CMS will identify to whom in the state those claims were released and ask that you 
submit a request for reuse of these data.  Please follow process listed under reuse 
request. 
 
2.  CMS will review the DUA and justification. The state will be contacted to clarify any 
questions CMS may have. Once the DUA and data justifications are approved, the DUA 
will be signed by the CMS representative and assigned a DUA number. Please allow 4 to 
8 weeks for initial processing of the DUA and justification. If you have any questions 
about the DUA or need any assistance completing the DUA, please contact Cheryl 
Sample on (410) 786-7185 or via e-mail at csample@cms.hhs.gov.  
 
3.  A CMS approval letter and a completed copy of the DUA with the assigned DUA 
number will be returned to the state.  
 
4.  The State's eligibility finder file should be submitted in the CMS required finder file 
format and contain no more than 3,000,000 records. If the finder file is in excess of this 
amount, additional finders should be submitted.  Finder Files must be provided using 
IBM standard 3480 cartridges or a 312 inch diskette.  Please see ENCLOSURE D for the 
finder file format specifications.  Also please see ENCLOSURE D for NCH SAF record 
specifications. 
  REUSE REQUEST 
 
Reuse of CMS data occurs when a requestor, from the same or a different organization requests 
permission to use CMS data already obtained for a prior approved project.  If another agency 
within your state has received claims data for the prior three years, CMS will identify to whom in 
the state those claims were released.  
 
The state must submit a formal request seeking written permission from CMS for the reuse of 
CMS data for third party liability purposes.   The requirements are as follows. 
 
1.  This package should include: 
 
  Written Letter of Request should specify:  
(cid:57) Name of data files and years of data files  
(cid:57) DUA number in which data files was originally obtained  
(cid:57) New purpose for which data needs to be reused  
 
  Written Letter of Support (from original requesting organization)  
 
  Data Use Agreement 
 
This package should be submitted to: 
 
Rebecca (Goldy) Rogers 
Centers for Medicare & Medicaid Services 
Center for Medicaid & State Operations 
Mailstop:S3-13-15 
7500 Security Blvd. 
Baltimore, MD 21244-1850 
Phone: (410) 786-6450 
  E-Mail: rrogers1@cms.hhs.gov 
 
2.  CMS will review the DUA and justification. The state will be contacted to clarify any 
questions CMS may have. Once the DUA and data justifications are approved, the DUA 
will be signed by the CMS representative and assigned a DUA number. Please allow 4 to 
8 weeks for initial processing of the DUA and justification. If you have any questions 
about the DUA or need any assistance completing the DUA, please contact Cheryl 
Sample on (410) 786-7185 or via e-mail at csample@cms.hhs.gov.    
 
3.  A CMS approval letter and a completed copy of the DUA with the assigned DUA 
number will be returned to the state.  
 
  ENCLOSURE B 
 
DATA USE AGREEMENT 
 
BETWEEN CENTERS FOR MEDICARE & MEDICAID SERVICES (CMS) AND THE  
 
STATE OF_____________________________________ 
 
AGREEMENT FOR USE OF CMS DATA CONTAINING INDIVIDUAL-SPECIFIC 
INFORMATION 
 
 
In order to secure data that resides in a CMS Privacy Act System of Records, and in order to 
ensure the integrity, security, and confidentiality of information maintained by CMS, and to 
permit appropriate disclosure and use of such data as permitted by law, CMS and the State of 
__________________________________________, enter into this agreement to comply with 
the following specific paragraphs. 
 
1.  This Agreement is by and between CMS, a component of the U.S. Department of Health and 
Human Services (DHHS), and ______________________________________, hereinafter 
termed User. 
 
2.  This Agreement addresses the conditions under which CMS will disclose and the User will 
obtain and use the National Claims History (NCH) Standard Analytical Files (SAFs) in 
section 7.   This Agreement supersedes any and all agreements between the parties with 
respect to the use of the NCH SAFs and preempts and overrides any instructions, directions, 
agreements, or other understanding in or pertaining to any grant award or other prior 
communication from the Department of Health and Human Services or any of its 
components with respect to the data specified within.  Further, the terms of this Agreement 
can be changed only by a written modification to this Agreement, or by the parties adopting a 
new agreement.  The parties agree further that instructions or interpretations issued to the 
User concerning this Agreement or the data specified herein, shall not be valid unless issued 
in writing by the CMS point-of-contact specified in section 5, or the CMS signatory to this 
Agreement shown in section 20. 
 
3.  The parties mutually agree that CMS retains all ownership rights to the data file(s) referred to 
in this Agreement, and that the User does not obtain any right, title, or interest in any of the 
data furnished by CMS. 
 
4.  The parties mutually agree that the following named individual is designated as Custodian 
of the file(s) on behalf of the User, and will be personally responsible for the observance of 
all conditions of use and for establishment and maintenance of security arrangements as 
specified in this Agreement to prevent unauthorized use.  The User agrees to notify CMS 
within fifteen (15) days of any change of custodianship.  The parties mutually agree that 
CMS may disapprove the appointment of a custodian, or may require the appointment of a 
new custodian at any time.  Page 2 
 
 
(Name of Custodian) 
 
 
(Company/Organization) 
  
 
(Street Address) 
 
 
(City/State/ZIP Code) 
 
 
(Phone Number Including Area Code and E-mail Address if applicable) 
 
5.  The parties mutually agree that the following named individual will be designated as  
point-of-contact for the Agreement on behalf of CMS. 
 
 
(Name of Contact) 
 
 
(Title/Component) 
  
 
(Street Address) 
 
 
(City/State/ZIP Code) 
 
 
(Phone Number Including Area Code and E-mail Address if applicable) 
 
6.  The User represents, and in furnishing the NCH SAFs, CMS relies upon such representation, 
that this file(s) will be used solely for the purpose(s) outlined below. 
 
To facilitate the coordination of benefits between the Medicare and Medicaid  
programs 
 
The User represents further that, except as specified in an Enclosure to this Agreement or 
except as CMS shall authorize in writing, the User shall not disclose, release, reveal, show, 
sell, rent, lease, loan, or otherwise grant access to the data covered by this Agreement to any 
person(s).  The User agrees that, within the User organization, access   Page 3 
 
to the data covered by this Agreement shall be limited to the minimum number of individuals 
necessary to achieve the purpose stated in this section and to those individuals on a need-to-
know basis only.  Disclosure of this data is made pursuant to: 
 
-  Freedom of Information Act (5 U.S.C. 552) 
-  Privacy Act (5 U.S.C. 552a) 
-  Section 1106 of the Social Security Act (42 U.S.C. 1306) 
-  Computer Matching and Privacy Protection Act of 1988 (P.L. 100-503) 
-  Section 1843 of the Social Security Act (42 U.S.C. 1395v) 
 
7.  CMS will provide the User with all paid, adjusted, and denied Standard Analytical Files, 
which is an extract from the National Claims History, System Number 09-70-0005.  
Medicare beneficiaries included in the NCH SAFs will vary from State to State depending on 
the number of Medicare beneficiaries residing in the State, present or past and on the size of 
the finder file submitted. The following files and timeframe are covered under this 
Agreement: 
 
File                  Timeframe 
 
Inpatient Claims               
Outpatient Claims 
Home Health Agency Claims 
Skilled Nursing Facility Claims 
Hospice Claims 
Durable Medical Equipment Claims 
Physician Supplier Part B Claims 
  
8.  The parties mutually agree that the aforesaid file(s) (and/or any derivative file(s) [includes 
any file that maintains or continues identification of individuals]) may be retained by the 
User for a 2-year time period from the effective date of this Agreement, hereinafter known as 
the retention date.  The User agrees to notify CMS within 30 days of the completion of the 
purpose specified above in section 6.  Upon such notice, CMS will notify the User either to 
return all data files to CMS at the Users expense, or to destroy such data.  If CMS elects to 
have the User destroy the data, the User agrees to certify the destruction of the files in writing 
within 30 days of CMSs instruction.  A statement certifying this action must be sent to CMS.  
If CMS elects to have the data returned, the User agrees to return all files to CMS within 30 
days of receiving notice to that effect.  The User agrees that no data from CMS records, or 
any parts thereof, shall be retained when the aforementioned file(s) are returned or destroyed 
unless authorization in writing for the retention of such file(s) has been received from the 
appropriate Systems Manager or the person designated in section 20 of this Agreement.  The 
User acknowledges that stringent adherence to the aforementioned information outlined in 
this paragraph is required.  The User also acknowledges that stringent adherence to the 
aforementioned retention date is required, and that the User shall ask CMS for instructions  under this paragraph if instructions have not been received after 30 days after the retention 
date. 
 
Page 4 
 
9.  The User agrees to establish appropriate administrative, technical, and physical safeguards to 
protect the confidentiality of the data, and to prevent its unauthorized use or access.  The 
safeguards shall provide a level and scope of security that is not less than the level and scope 
of security established by the Office of Management and Budget (OMB) in OMB Circular 
No. A-130, Appendix III--Security of Federal Automated Information Resources 
(http://www.whitehouse.gov/omb/circulars/a130/a130.html), which sets forth guidelines for 
security plans for automated information systems in Federal agencies.  The User 
acknowledges that the use of unsecured telecommunications, including the Internet, to 
transmit individually identifiable or deducible information derived from the file(s) specified 
in section 7 is strictly prohibited.  Further, the User agrees that the data must not be 
physically moved or transmitted in any way from the site indicated above in section 4, 
without written approval from CMS. 
 
10. The User agrees that the authorized representatives of CMS, DHHS Office of the Inspector 
General or Comptroller General, will be granted access to premises where the aforesaid 
file(s) are kept for the purpose of inspecting security arrangements confirming whether the 
User is in compliance with the security requirements specified in section 9. 
 
11. The User agrees that no findings, listing, or information derived from the file(s) specified in 
section 7, with or without identifiers, may be released if such findings, listing, or information 
contain any combination of data elements that might allow the deduction of a beneficiarys 
identification, without first obtaining written authorization from the appropriate System 
Manager or the person designated in section 20 of this Agreement.  (Examples of such data 
elements include, but are not limited to, address, sex, age, medical diagnosis, procedure, 
admission/discharge dates, date of death, etc.)  The User agrees further that CMS shall be the 
sole judge as to whether any finding, listing, or information, or any combination of data 
extracted or derived from CMSs files identifies or would, with reasonable effort, permit one 
to identify an individual or to deduce the identity of an individual with a reasonable degree of 
certainty. 
 
12. The User agrees that, absent express written authorization from the appropriate System 
Manager or the person designated in section 20 to do so or as outlined in this agreement, the 
User shall make no attempt to link records included in the file(s) specified in section 7 to any 
other identifiable source of information.  This includes attempts to link to other CMS data 
files.  
 
13. The User understands and agrees that they may not reuse original or derivative data file(s) 
without prior written approval from the appropriate System Manager or the person 
designated in section 20 of this Agreement. 
  Page 5 
 
14. The parties mutually agree that the following specified Enclosures are part of this 
Agreement: 
 
 
 
  
15. The User agrees that in the event CMS determines or has a reasonable belief that the User 
has made or may have made disclosure of the aforesaid file(s) that is not authorized by this 
Agreement, or other written authorization from the appropriate Systems Manager or the 
person designated in section 20, CMS in its sole discretion may require the User to: (a) 
promptly investigate and report to CMS the Users determinations regarding any alleged or 
actual unauthorized disclosure, (b) promptly resolve any problems identified by the 
investigation; (c) if requested by CMS, submit a formal written response to an allegation of 
unauthorized disclosure; (d) if requested by CMS, submit a corrective action plan with steps 
designed to prevent any future unauthorized disclosures; and (e) if requested by CMS, return 
data files to CMS immediately.  The User understands that as a result of CMSs 
determination or reasonable belief that unauthorized disclosures have taken place, CMS may 
refuse to release further CMS data to the User for a period of time to be determined by CMS. 
 
16. The User hereby acknowledges that criminal penalties under 1106(a) of the Social Security 
Act (42 U.S.C. 1306(a)), including a fine not exceeding $10,000 or imprisonment not 
exceeding 5 years, or both, may apply to disclosures of information that are covered by 
1106 and that are not authorized by regulation or by Federal law.   The User further 
acknowledges that criminal penalties under the Privacy Act (5 U.S.C. 552a(i)(3)) may apply 
if it is determined that the Requestor or Custodian, or any individual employed or affiliated 
therewith, knowingly and willfully obtained the file(s) under false pretenses.  Any person 
found guilty under the Privacy Act shall be guilty of a misdemeanor and fined not more than 
$5,000.  Finally, the User acknowledges that criminal penalties may be imposed under 18 
U.S.C. 641 if it is determined that the User, or any individual employed or affiliated 
therewith, has taken or converted to his own use data file(s), or received the file(s) knowing 
that they were stolen or converted.  Under such circumstances, they shall be fined under Title 
18 or imprisoned not more than ten years, or both.   
 
17. By signing this Agreement, the User agrees to abide by all provisions set out in this 
Agreement for protection of the data file(s) specified in section 7, and acknowledges having 
received notice of potential criminal and administrative penalties for violation of the terms of 
the Agreement. 
 
18. On behalf of the User, the undersigned individual hereby attests that he or she is authorized 
to enter into this Agreement and agrees to all the terms specified herein. The duration of this 
Agreement is two years from the effective date.  Either party may  Page 6 
 
independently terminate the agreement upon written request to the other party, in which case 
the termination shall be effective 30 days after the date of the notice, or at a later date 
specified in the notice. 
 
___________________________________________________________ 
 (Name/Title of Individual) 
 
___________________________________________________________ 
 (State Agency/Organization) 
  
___________________________________________________________ 
 (Street Address) 
 
___________________________________________________________ 
 (City/State/ZIP Code) 
 
___________________________________________________________ 
 (Phone Number Including Area Code and E-mail Address if applicable) 
 
___________________________________________________________ 
Signature                                                                               Date 
 
20. On behalf of CMS the undersigned individual hereby attests that he or she is authorized to 
enter into this Agreement and agrees to all the terms specified herein. 
 
___________________________________________________________ 
 (Typed or Printed Name and Title of CMS Representative) 
 
___________________________________________________________ 
 Signature                 Date 
 
21. The disclosure provision(s) that allow the discretionary release of CMS data for the 
purpose(s) stated in paragraph 6 follow(s).  (To be completed by CMS staff) 
 
National Claims History, Systems of Record #09-70-0005, routine use #12  
 
 
  ENCLOSURE C 
 
INSTRUCTIONS FOR COMPLETING THE DATA USE AGREEMENT (DUA) 
 
 This agreement is needed in order for you to receive the NCH SAFs to ensure compliance to the 
requirements of the Privacy Act, and must be completed prior to the release of file. 
 
Directions for the completion of the agreement follow: 
 
Before completing the DUA, please note the language contained in this agreement cannot be 
altered in any form . 
 
  First paragraph, enter the Name of the State Agency. 
 
  Item #1, enter the Name of the State Agency. 
 
  Item #4, enter the Custodian Name, State Agency Department or Contractor 
Organization, Address, Phone Number (including area code), and E-Mail Address (if 
applicable).  The Custodian of files is defined as that person who will have actual 
possession of and responsibility for the data files.  This section should be completed 
even if the Custodian and Requestor/User are the same. 
 
  Item #18 is to be completed by Requestor/User. 
 
  Item #19 is to be completed by Custodian. 
 
  Item #20 will be completed by the CMS representative. 
 
 
If you have any questions about the DUA or need any assistance completing the DUA, please 
contact Cheryl Sample on (410) 786-7185 or via e-mail at csample@cms.hhs.gov.  Submit the 
original signed DUA and request letter to: 
 
Rebecca (Goldy) Rogers 
Centers for Medicare & Medicaid Services 
Center for Medicaid & State Operations 
Mailstop S3-13-15 
7500 Security Boulevard 
Baltimore, MD  21244-1850 
Phone: (410) 786-6450 
E-Mail: rrogers1@cms.hhs.gov 
 
  ENCLOSURE D 
 
CMS FINDER FILE RECORD SPECIFICATIONS  
 
14 Byte HIC Finder File 
       
  Field name    Field Size    Location    Remarks 
       
Health Insurance Claim Number    11    1 - 11  User Supplied 
Search Argument 
       
Filler    2    12 - 13  Blank or  
Requestor=s Identifier 
       
Sex    1    14  0 = Unknown 
1 = Male 
2 = Female 
 
14 Byte SSN Finder File 
 
       
  Field name    Field Size    Location    Remarks 
       
Social Security  Number    9    1 - 9  User Supplied 
Search Argument 
       
Filler    2    10 - 13  Blank or  
Requestor=s Identifier 
       
Sex    1    14  0 = Unknown 
1 = Male 
2 = Female