Research and MCD Guidance

• Guidance is also available in Portable Document Format (PDF)

MCD Sponsorship Request Toolkit
Guidance: Research and Medicaid Confidential Data
Introduction	This document provides guidance to help MCD requestors complete each section of the MCD Sponsorship Request Form. Completing the MCD Sponsorship Request Form and supporting documentation does not guarantee approval of request. Guidance is provided for informational purposes only and is not legal advice.
What is research?	Under the HIPAA Privacy rule, research is defined as "a systematic investigation, including research development, testing, and evaluation, designed to develop or contribute to generalizable knowledge." 45 CFR 164.501
When can MCD be used for research?	Following state and federal laws, MCD may be used for research that supports the administration of the New York State (NYS) Medicaid Program. Only MCD sponsors can determine if the research supports the administration of the NYS Medicaid Program. MCD may be used for research in compliance with federal and state laws.
Under the HIPAA Privacy Rule, covered entities are permitted to use and disclose protected health information for research with individual authorization, or without individual authorization under limited circumstances set forth in the HIPAA Privacy Rule. Individual authorization means that the data subject provides informed consent, which is valid under the HIPAA Privacy Rule, for participating in research. Absent individual authorization a covered entity must obtain documented Institutional Review Board (IRB) or Privacy Board Approval.
What is an Institutional Review Board (IRB)?	An IRB is a formally designated group that reviews and monitors research involving human subjects. The IRB has the authority to review research proposals and provide approval, require modifications in (to secure approval), or disapprove research.
What do I need to do if I want to use MCD for research?	MCD requestors conducting research are required to submit evidence that their research proposal has been reviewed and approved by their institution´s IRB. MCD requestors will be asked to provide their research protocol as well as: Identification of the IRB or Privacy Board and the date on which the alteration or waiver of authorization was approved; A statement that the IRB or Privacy Board has determined that the alteration or waiver of authorization, in whole or in part, satisfies the three criteria in the HIPAA Privacy Rule; A brief description of the protected health information for which use, or access has been determined to be necessary by the IRB or Privacy Board; A statement that the alteration or waiver of authorization has been reviewed and approved under either normal or expedited review procedures; and The signature of the chair or other member, as designated by the chair, of the IRB or the Privacy Board, as applicable.
Questions? Contact us!	doh.sm.medicaid.data.exchange@health.ny.gov