DSRIP Performing Provider Systems for

Completing the Data Exchange Application and Agreement (DEAA)

• DEAA FAQs is also available in portable document format (PDF)

These Frequently Asked Questions (FAQs) will provide guidance to Performing Provider Systems (PPSs) in order to submit the Data Exchange Application and Agreement (DEAA). The DEAA is due back to the Security and Privacy Bureau doh.sm.Medicaid.data.Exchange@health.ny.gov. Please note that copies of your entity´s privacy and security policies and procedures must be submitted with the DEAA, as discussed in Section 6.

Question Number	Question	Answer
1	Will PPS have additional opportunities to complete the BAA/subcontractor document for additional subcontractors in the future?	Yes. Subcontractor BAAs and documentation may occur at any time that a PPS engages with them. Subcontractors may be added at any time by completing Attachment D and submitting a BAA to doh.sm.Medicaid.data.Exchange@health.ny.gov.
2	How are the applications to be submitted?	A PDF sent via email is the preferred method given the short timeframe. Hard copies ARE NOT required and should NOT be sent.
3	In Section 3 [Deliverables] is the "no PHI" verbiage a typo as this all pertains to PHI?	Yes. This is a typo.
4	What type of personnel should assume the gatekeeper role?	It should be a trusted individual who is responsible for identity proofing all users, and is strongly familiar with HIPAA/HITECH. The should have the ability and bandwidth to handle the gatekeeper role, which includes accurately maintaining a list of all users and end dates, that is auditable by CMS and DOH. They must also be able to produce a list of users at any qiven time, if requested by DOH or CMS audit.
5	How is this DEAA different from the prior one that was signed earlier during the DSRIP program?	This DEAA allows the PPS to access Protected Health Information (PHI) Medicaid claims data when it becomes available, for the population of members attributed to your PPS.
6	Does the DEAA end in five years after it comes into effect, or at the end of DY5?	As it currently stands, we expect the DSRIP program to continue in some form, after the five year period. It is likely the future of treating Medicaid patients. At this time you do not need to identify how you will dispose of the data at the end of the five year period. You may leave that question blank.
7	Should a PPS sign the DEAA with their legal name or the name they would like to be referred to going forward?	The PPS should sign the DEAA with the current, legal name. When the PPS´ legal name changes, the PPS will be required to submit a DEAA amendment (a short 4 pg. document) to officially change its name. However, while the DEAA is a legal document that needs to have the entities legal name, the State understands that some PPS would like to have a public facing, collaborative name on public DSRIP documents. Hence, the DOH is seeking approval from the State´s legal department to allow PPS to list their legal name in the DEAA and have a "nickname" for public documents. To reiterate, this exception only in the works and has not been approved. For the purposes of the DSRIP DEAA, PPS must use their current, legal name. We will be updating PPS shortly if an amendment is approved.