What is the MCD Sponsorship?

• Guidance is also available in Portable Document Format (PDF)

MCD Sponsorship Request Toolkit
Guidance: Medicaid Confidential Data (MCD) Sponsorship Request Form
What is the MCD Sponsorship Process?	The New York State Department of Health (NYSDOH) Office of Health Insurance Programs (OHIP) must ensure that Medicaid Confidential Data is only used in compliance with state and federal laws. MCD may only be used to administer the NYS Medicaid Program for activities that are defined such as: Health Care Operations Public Health Surveillance Research When data requestors outside of NYSDOH OHIP seek to use MCD to administer the NYS Medicaid Program, the request is reviewed through an established process called "MCD Sponsorship".
What do I have to do to be sponsored?	Data requestors are required to demonstrate that their proposed use of MCD administers the NYS Medicaid Program. To meet this criteria, data requestors must email the OHIP Security and Privacy Bureau (Bureau) to provide information about the data request. The Bureau will provide the data requestor with the "MCD Sponsorship Request Form". The requestor must complete the form in its entirety and return it to the Bureau. The Bureau may ask for additional information or clarification before sharing the request with NYS Medicaid experts who will determine if the request is sponsored. OHIP Sponsors must consider many factors when choosing to sponsor a data request. Therefore, it may take some time for a final decision to be made. You will be notified via email if your data request is sponsored.
What happens after my data request is sponsored?	Once your request is sponsored, you must meet the security and privacy standards set by OHIP before you may access or use MCD. The security and privacy standards ensure that data is only used in compliance with state and federal laws and regulations. The Bureau will send you a pre-populated data-sharing agreement that outlines the acceptable uses of the data and describe how you will protect the privacy and confidentiality of the data. You must submit an executed data-sharing agreement to the Bureau, along with a completed Names List, and any Business Associate Agreements (BAA). You must also demonstrate that you meet the security standards for accessing MCD. Which standards you must meet depend on how you are accessing the data. You will work with the Bureau to determine the data access method most appropriate to your request.
What happens after I access the data?	Over the course of your project you are responsible for updating the data-sharing agreement, Names List, and BAAs if there are changes to your data request or your staff supporting the data request. You are required to provide these updates as a provision of your data sharing agreement. If there is a breech or adverse event during your project period, you are required to notify the Bureau immediately.
What happens when the project ends?	At the end of the project period you will no longer have access to MCD. You will be required to submit a "Data Destruction Affidavit" to the Bureau. You will receive a letter from the Bureau confirming your project closure.
If you have any questions, please contact us!	d oh.sm.medicaid.data.exchange@health.ny.gov