Items 1 to 3: parties and ownership
The State's name, the scope of the agreement, when CMS may end it, and that CMS keeps all ownership rights to the data files.
CMS-R-0235M
Medicaid Agency Data Use Agreement
- Agency
- CMS
- Revision
- 07/07
- Fillable fields
- 45
- Pages
- 6
- Official source
- CMS form page
- Checked
- October 20, 2026
Form CMS-R-0235M: Medicaid Agency Data Use Agreement (DUA)
Form CMS-R-0235M is the Medicaid Agency Data Use Agreement (DUA) from the Centers for Medicare & Medicaid Services. Its instructions say the agreement ensures compliance with the Privacy Act and is required for a State Medicaid Agency to receive LTC/MDS data deriving from Medicare and private pay residents, before those files are released.
The agreement is between CMS and a State, called the User. It covers the Medicare Long Term Care Minimum Data Set (LTC/MDS), the purposes the data may be used for, a 10 year retention period, security safeguards, limits on releasing findings and what CMS may require after an unauthorized disclosure. The State signs it, names a Custodian of the files, and CMS completes its own point-of-contact and signature items.
The instructions say the language of the agreement cannot be altered. The form carries OMB number 0938-0734. You can fill it out free in your browser on this page and download the result without an account.
What's on Form CMS-R-0235M
Items 4 and 5: purpose and files
The purposes the data may be used for, limits on access and disclosure, and the files covered, pre-filled as LTC/MDS Resident Assessment Data Files, with the years.
Items 6 to 8: retention and security
Keeping the files for up to 10 years, administrative, technical and physical safeguards, and access for CMS, the DHHS Office of the Inspector General or the Comptroller General to inspect security.
Items 9 to 13: release limits
Limits on releasing findings that could identify a beneficiary, steps CMS may require after an unauthorized disclosure, criminal penalties that may apply, and the disclosure provision for System of Records 09-70-1517, routine use 2(c).
Items 14 and 15: User and Custodian
Name, agency or organization, street address, city, state, ZIP code, office telephone, optional email, signature and date for the User and for the Custodian.
Items 16 and 17: CMS
The CMS point-of-contact and the CMS representative, with signature lines to concur or nonconcur for the System Manager or Business Owner and the Protocol or Project Review Representative.
Two pages of instructions are followed by the four page agreement.
How to fill out Form CMS-R-0235M
- 1
Enter the State
Enter the name of the State in the first paragraph and in Item 1.
- 2
Choose the years in Item 5
The file is pre-completed. The instructions say the agency may choose a time period from a point in the past through up to 10 years into the future, such as 2001 or 1998-2000.
- 3
Complete Item 14
The State Medicaid Agency enters the user's name, agency, address, office phone and email if applicable, then signs and dates.
- 4
Name the Custodian in Item 15
Enter the Custodian's name, organizational unit, address, phone and email if applicable. The instructions say the same person can sign as User and Custodian.
- 5
Add contractor custodians
Each additional custodian organization completes and signs the Multi-Signature Addendum form, according to the instructions.
- 6
CMS completes Items 16 and 17
The instructions say Item 16 is completed by the RO MDS Representative and Item 17 by the CMS Regional and Central Office.
These steps follow the instructions on the first two pages.
Why fill Form CMS-R-0235M on indox
You get the real form, filled in a browser tab, with nothing standing between you and the finished PDF.
- Fill the form right in your browser, no software to install
- Free to fill and free to download, with no account
- The official blank straight from the CMS, not a copy someone retyped
- Works on a phone, tablet or computer
What the agreement and instructions say
Medicaid-only data
The instructions say no DUA is needed for release of LTC/MDS data derived only from Medicaid residents, but all data releases to the Medicaid Agency are electronically tracked for HIPAA compliance.
Retention date
The instructions say the files may be kept for 10 years after the approval date (the CMS signature date), called the retention date, and that it does not move forward with each data release.
Renewing
To keep receiving data past the 10 year point, the instructions say to contact CMS at least 30 days before the retention date, preferably 3 to 4 months before, to request another DUA.
New custodians
To add a custodian to an existing DUA, the instructions say to send the CMS Regional Office a letter describing the planned activities and length of service, and a Multi-Signature Addendum showing the existing DUA number.
Change of custodian
Item 15 says the User agrees to notify CMS within fifteen (15) days of any change of custodianship.
OMB number
The form shows OMB No. 0938-0734. The CMS page lists an OMB expiration date of 2014-12-31.
Related forms
CMS-R-0235MA
Addendum to the Medicaid State Agency Data Use Agreement
26 fields, 1 page
CMS-R-0235MC
Compliance Plan for Accounting for Disclosures of Privacy Protected Data Released From a System of Records (SOR) Housed in a State-Located Server
10 fields, 1 page
CMS-R-0235A
Addendum to Data Use Agreement (DUA)
16 fields, 1 page
CMS-R-0235U
Data Use Agreement (DUA)- Update to Existing DUA
38 fields, 1 page
CMS-R-0235L
Data Use Agreement (DUA)- Limited Data Sets
50 fields, 6 pages
Who uses Form CMS-R-0235M?
The instructions say who completes each signature item.
Official sources and the blank
Do it all with indox
No tool matches that search.
Questions about Form CMS-R-0235M
What is Form CMS-R-0235M for?
The instructions say it is required for a State Medicaid Agency to receive LTC/MDS data deriving from Medicare and private pay residents, and is completed before those files are released.
Is a DUA needed for Medicaid-only data?
The instructions say no DUA is needed for LTC/MDS data derived only from Medicaid residents, though all releases to the Medicaid Agency are electronically tracked for HIPAA compliance.
Can the wording of the agreement be changed?
No. The instructions say the language in the agreement cannot be altered in any form. Item 2 says its terms change only by a written modification or a new agreement.
How long can the agency keep the data?
Item 6 says up to 10 years from the effective date, called the retention date. The instructions describe it as 10 years after the approval date, the CMS signature date.
Can the User and the Custodian be the same person?
Yes. The instructions say a person signing for the Medicaid agency as User who is also the Custodian can appear and sign in both places.
What is the Custodian?
The instructions define the Custodian as the person who will have actual possession of and responsibility for the data files, typically the manager of the Medicaid agency unit responsible for them.