Code of Maryland Regulations › Title 10 - MARYLAND DEPARTMENT OF HEALTH › Part 4 › Subtitle 25 - MARYLAND HEALTH CARE COMMISSION › Chapter 10.25.05 - Small Group Market Data Collection › Section 10.25.05.13 - Data Use Agreement

Current through Register Vol. 51, No. 14, July 12, 2024
A. An
				  approved applicant shall enter into and sign a data use agreement prior to
				  receipt of the requested data. If an approved applicant does not sign a data
				  use agreement within 30 days of the date of written notification of application
				  approval, the application shall be deemed withdrawn and will receive no further
				  consideration.
B. Prior to entry
				  into a data use agreement and receipt of requested data, an approved applicant
				  shall disclose any data sharing plan or agreement required by a funding source
				  as a condition of an applicant's receipt of funding.
C. A data use agreement entered into with a
				  data recipient under §A of this regulation shall, at a minimum:
(1) Define the scope of use of the requested
				  data and the research methodology;
(2) Provide a plan for safeguarding the
				  privacy and security of the data and complying with all applicable laws
				  governing the privacy and security of data;
(3) Require a data recipient to adhere to
				  security processes and procedures aimed at preventing unauthorized access, use,
				  or disclosure of the data;
(4)
				  Require that a data recipient notify Commission staff of any potential or
				  actual data breach, including any instance of unauthorized access, use, or
				  disclosure of data, no later than 7 days from the date of knowledge of the
				  breach;
(5) Require a data
				  recipient to notify Commission staff in writing within 24 hours of receipt of
				  any request from a third party requesting a data recipient to disclose all or
				  part of the data received from the Commission, including but not limited to
				  compulsory process, such as a subpoena, discovery request, warrant, or judicial
				  or administrative order, or a public information act request, to provide the
				  Commission adequate time to intervene and respond before the date that a data
				  recipient has been requested or ordered to provide the data;
(6) Specify the beginning and end dates of a
				  data use agreement;
(7) Provide for
				  the return or destruction of data by a certain date upon termination of a data
				  use agreement, or upon a determination that a data recipient has failed to
				  comply with a data use agreement;
(8) Require that a data recipient comply and
				  assist, if requested, in any audit of compliance with a data use
				  agreement;
(9) Provide that a
				  breach of any term or condition of a data use agreement is a breach of
				  contract;
(10) Permit that
				  appropriate administrative and judicial remedies under applicable law may be
				  pursued against a data recipient for failing to comply with the terms and
				  conditions of a data use agreement; and
(11) Be signed by:
(a) A person authorized to contractually bind
				  a data recipient's organization; or
(b) A data recipient, if a data recipient is
				  not part of an organization.