MATRIS Confidential Data Reporting and Use Agreement

This MATRIS Confidential Data Reporting Agreement (“Agreement”) is made as of __________________, 201__, by the following Ambulance Service on its own behalf and on behalf of its officers, agents, directors, employees, assigns and successors (Reporting Entity):

__________________________________________                        ____________________	 
Ambulance Service (Reporting Entity)				Service License #				

The purpose of this Agreement is to protect the security, confidentiality and integrity of the Massachusetts Department of Public Health (DPH) MATRIS system by setting forth the terms and conditions governing the submission of data to, and use of reports from, MATRIS.   The terms and conditions govern both business practices and electronic computer systems accessing the data.

The Reporting Entity acknowledges that DPH retains ownership of all data that resides in MATRIS.

SECTION 1: DEFINITIONS 

AR 5-403:  Administrative Requirement 5-403, which establishes the statewide EMS minimum data set required to be collected and submitted to DPH, based on NEMSIS, the National EMS Information System Data Set.  

Confidential Data:  any individually identifiable data, including but not limited to, medical and demographic data that: 1) reveals the identity of the data subject or is readily identified with the data subject, including, but not limited to, name, address, telephone number, social security number, health identification number, or date of birth, or 2) provides a reasonable basis to believe that the data could be used, either alone or in combination with other information, to identify a data subject. Confidential data includes any protected health information, as defined by the Health Insurance Portability and Accountability Act (HIPAA), Public Law 104-191, and regulations at 45 CFR Part 160 and subparts A and E of Part 164, and any personal data, as defined by the Fair Information Practices Act (FIPA),  M.G.L. c. 66A. 

Data Subject:  the individual about whom the data or information relate.

Designated Reporting Entity MATRIS Administrator: the Designated Reporter/User designated by the Reporting Entity to establish ambulance service information in MATRIS, including but not limited to locations, vehicles, staff lists, and responsible for creation and deactivation of Designated Reporter/User accounts for the ambulance service.  

Designated Reporter/User:  a person authorized by the Reporting Entity to access MATRIS  in accordance with the terms and conditions of this Agreement and who has completed and signed a MATRIS Designated Reporter/User Agreement, in the form attached to this Agreement,  A Designated Reporter/User may be an employee, contractor or agent of the Reporting Entity.

MATRIS:  the Massachusetts Ambulance Trip Record Information System, an Internet-based application that collects the data elements required by AR 5-403.     

MATRIS Designated Reporter/User Agreement:  the Agreement executed by each Designated Reporter/User.

Reporting Entity:  entities required by M.G.L. c. 111C, 105 CMR 170.347 and AR 5-403 to submit the data elements to DPH.  

SECTION 2: RESPONSIBILITIES OF THE REPORTING ENTITY

1.	The Reporting Entity shall use MATRIS to submit all data required by A/R 5-403 to DPH. 

2.	The Reporting Entity shall designate a minimum of two (2) Designated Reporters/Users who will be responsible for the submission on its behalf of data required by AR 5-403 to DPH.  

3.	The Reporting Entity shall designate one (1) Designated Reporter/User to serve as the Designated Reporting Entity MATRIS Administrator for the Reporting Entity, and shall notify the DPH MATRIS system administrator of that designation.  The Reporting Entity shall ensure that the Designated Reporting Entity MATRIS Administrator completes any training or other requirements specified by DPH.

4. 	 The Reporting Entity shall ensure that each Designated Reporter/User completes and signs a MATRIS Designated Reporter/User Agreement in the form attached to this Agreement.  

5. 	The Reporting Entity shall retain the executed MATRIS Designated Reporter/User Agreements.  

6.	The Designated Reporting Entity MATRIS Administrator shall assign a specific individual MATRIS user ID for each Designated Reporter/User who completes and signs a MATRIS Designated Reporter/User Agreement. 

7. 	The Reporting Entity shall ensure that each Designated Reporter/User uses only his or her specifically assigned user ID and password to access MATRIS and that such information will not be shared with any other person and/or entity.  
.	
8. 	The Reporting Entity shall immediately notify DPH when a Designated Reporter/User terminates employment or is no longer authorized to access MATRIS for any reason, and the Designated Reporting Entity MATRIS Administrator shall immediately deactivate that person’s MATRIS user ID.

9.	The Reporting Entity shall immediately notify the DPH MATRIS system administrator if any breach of this Agreement and/or MATRIS Designated Reporter/User Agreement has occurred.   Such notification shall include the identity of all individuals involved and the nature of the breach. 

10.	The Reporting Entity and its Designated Reporters/Users shall use a browser that supports 128-bit SSL 3 or TLS (or stronger) encryption.  
 
11.	The Reporting Entity shall purchase and maintain, on all user machines, up-to-date anti-virus software to prevent the input or uploading of any viruses or other disabling or malicious code capable of disrupting or disabling computer hardware or software.  Said machines shall also be kept up to date with respect to software patches for operating systems and relevant application software. 

12.	The Reporting Entity shall retain a copy of all data submitted to MATRIS sufficient to enable it to be resubmitted if the original submission is lost or destroyed before it is processed by DPH.  When the Reporting Entity has been notified by DPH that the data have been processed, the copy must be destroyed using secure deletion tools such as sdelete or DBAN so as to render storage media unreadable and otherwise unusable. In the case of write-once removable media e.g. tapes or CD-ROMs, all such backups will be destroyed by degaussing (if magnetic in nature) followed by shredding.  

13.	The Reporting Entity shall be solely responsible for the preservation, privacy, and security of data covered by this Agreement in its possession. 

14.	The Reporting Entity agrees:

(a)	not to use, copy, disclose, publish, distribute or alter any data, data transmission, or the control structure applied to transmissions for any purpose other than the purpose for which the Reporting Entity was specifically given access and authorization by the DPH;

(b)	not to obtain access to any data, transmission, or DPH’s systems by any means or for any purpose other than as DPH has expressly authorized the Reporting Entity; and to immediately notify DPH if it  receives data not intended for receipt by the Reporting Entity, and arrange for its return or resubmission as DPH directs. After such return or resubmission, the Reporting Entity will immediately delete and perform a security wipe of all copies of such data remaining in its possession as described in section 10. 

15.	The Reporting Entity shall ensure that the information submitted in each electronic transmission is timely, complete, accurate and secure, and shall prevent unauthorized access to (a) the transmission and processing systems, (b) the transmissions themselves, and (c) the control structure applied to transmissions between them.

16.	The Reporting Entity acknowledges that its breach of any provision of this Agreement may subject it to enforcement by DPH, in accordance with 105 CMR 170.705 et. al, and 105 CMR 170.265. 

The signer of this Agreement must be legally authorized to sign on behalf of the Reporting Entity. Preferably, the signer should be the Reporting Entity’s chief executive officer

___________________________________________		_________________		
Reporting Entity Authorized Signature				Date

___________________________________________		_________________
Printed Name of Authorized Signatory				Title

Authorized signatory contact information:

____________________________			_______________________________
Telephone Number					Email address

_______________________________________________  
Street Address

_____________________________________
City, State, ZIP Code 

MATRIS Designated Reporter/User Agreement

_________________________________________                                      _______________
Ambulance Service (Reporting Entity)					Service License #

I, _________________________________________________________, 
Name of Designated Reporter/User

have been designated by the above named Reporting  Entity to submit data to, and use reports from, MATRIS, the Massachusetts Ambulance Trip Record Information System, in accordance with the MATRIS Confidential Data Reporting Agreement and this Designated Reporter/User Agreement.

Check the type of access for this Designated Reporter/User	
Check One	User Profile	Functions	
	MATRIS Administrator	The person responsible for the MATRIS Administration (creates and maintains web user accounts online and via paper forms.)
Also has the ability to: submit information, download, edit, view and print reports as determined by DPH. 	
	MATRIS Designated Reporter/User	Ability to: submit information, download, edit, view and print reports as determined by DPH	
	Medical Director	Ability to: download, edit, view and print reports as determined by DPH.	

I agree to use MATRIS in accordance with the terms of this Agreement as follows:

•	I will not disclose my MATRIS user ID and/or password to any person or entity.
•	I will access, use and/or review MATRIS data only as required to perform my job duties for the above-named Reporting Entity.
•	I will not share any data I receive from MATRIS with others unless such sharing is necessary to perform my job duties on behalf of the above-named Reporting Entity.
•	 I will discuss data received from MATRIS with others only as required to perform my job duties for the above-named Reporting Entity and will conduct such discussions only in non-public areas to ensure that I am not overheard. 
•	I will not disclose any data that I receive from MATRIS to third parties unless I have specific written permission from the Reporting Entity’s MATRIS Administrator or a court order compels such disclosure.
•	I understand that DPH retains ownership of all data that resides in MATRIS.  
•	I understand that the above-named Reporting Entity may terminate this designation at any time, for any reason.  
•	If I am a Designated Reporting Entity MATRIS Administrator, I will only create, deactivate or otherwise manage MATRIS user IDs as authorized by DPH.

Designated Reporter/User Complete Name:  ________________________________________

Job Title and Professional Credential: ____________________________________________ 

MATRIS Designated Reporter/User Agreement, Page 2

Work Mailing Address (include name of company and department):

______________________________________________________________________

________________________________________________________________________

Work Email Address:__________________________________________________

Work Telephone: _________________________Work Fax: __________________________

I hereby acknowledge I have read the above terms and conditions and agree to be bound thereby as a condition of access to and use of MATRIS.

________________________________________               ___________________________
Designated Reporter/User Signature				Date

Reporting Entity Signature (preferably, the signatory should be the Reporting Entity’s chief executive officer):

________________________________________               ___________________________            
Reporting Entity Authorized Signatory			Date

________________________________________               ___________________________
Printed Name of Authorized Signatory			Title