State and system of records
The State, and the SOR from which data is requested, MDS or OASIS.
CMS-R-0235MC
Compliance Plan for Accounting for Disclosures of Privacy Protected Data Released From a System of Records (SOR) Housed in a State-Located Server
- Agency
- CMS
- Revision
- 03/06
- Fillable fields
- 10
- Pages
- 1
- Official source
- CMS form page
- Checked
- October 20, 2026
Form CMS-R-0235MC: Compliance Plan for Accounting for Disclosures From a State SOR Server
Form CMS-R-0235MC is the Compliance Plan for Accounting for Disclosures of Privacy Protected Data Released From a System of Records (SOR) Housed in a State-Located Server, from the Centers for Medicare & Medicaid Services. The form says this compliance plan must be attached to any Data Use Agreement request made by a State health department or Medicaid agency.
The one page plan names the State, the SOR the data is requested from (MDS or OASIS), the requestor and the State agency where the SOR server is located. A State agency technical contact, who will release the data or oversee the release, signs a statement that under the Privacy Act of 1974 and HIPAA the State will be able to account for disclosures of individually identifiable information from that SOR, with a brief description of the process it will use.
The form carries OMB number 0938-0734 and estimates 30 minutes per response. You can fill it out free in your browser on this page and download the result without an account.
What's on Form CMS-R-0235MC
Requestor
Name of the individual, title and organization.
Server location and technical contact
The State agency in which the SOR server is located, and the technical contact's printed name, office telephone with area code and email address if applicable.
Accounting statement and signature
A statement citing the Privacy Act of 1974 and HIPAA, a brief description of the process used to account for disclosures, then signature and date.
The form is a single page.
How to fill out Form CMS-R-0235MC
- 1
Name the State and the SOR
Enter the State and the system of records the data is requested from, MDS or OASIS.
- 2
Identify the requestor
Enter the requestor's name, title and organization.
- 3
Name the server agency and contact
Enter the State agency where the SOR server is located and the technical contact's name, phone and email.
- 4
Describe the accounting process
Write a brief description of the process the State will use to account for disclosures from the SOR.
- 5
Sign and attach
The technical contact signs and dates the form, and the form says it is attached to the Data Use Agreement request.
Why fill Form CMS-R-0235MC on indox
You get the real form, filled in a browser tab, with nothing standing between you and the finished PDF.
- Fill the form right in your browser, no software to install
- Free to fill and free to download, with no account
- The official blank straight from the CMS, not a copy someone retyped
- Works on a phone, tablet or computer
Where it goes and what the form says
Where it goes
The form says it is attached to the State's Data Use Agreement request. It prints no separate mailing address; the CMS address in the PRA statement is for comments on the time estimate.
Data systems covered
The form names two systems of records: MDS and OASIS.
Laws cited
The statement refers to the disclosure requirements of the Privacy Act of 1974 and the Health Insurance Portability and Accountability Act of 1996 (HIPAA).
OMB number and time
OMB No. 0938-0734, with an estimate of 30 minutes per response. The CMS page lists an O.M.B. expiration date of 2014-12-31.
Related forms
CMS-R-0235M
Medicaid Agency Data Use Agreement
45 fields, 6 pages
CMS-R-0235MA
Addendum to the Medicaid State Agency Data Use Agreement
26 fields, 1 page
CMS-R-0235A
Addendum to Data Use Agreement (DUA)
16 fields, 1 page
CMS-R-0235L
Data Use Agreement (DUA)- Limited Data Sets
50 fields, 6 pages
CMS-R-0235U
Data Use Agreement (DUA)- Update to Existing DUA
38 fields, 1 page
Who uses Form CMS-R-0235MC?
The form names the agencies that attach it and the person who signs it.
Official sources and the blank
Do it all with indox
No tool matches that search.
Questions about Form CMS-R-0235MC
When is Form CMS-R-0235MC used?
The form says this compliance plan must be attached to any Data Use Agreement request made by a State health department or Medicaid agency.
Which data systems does it cover?
The form asks for the SOR from which data is requested and names MDS or OASIS.
Who signs Form CMS-R-0235MC?
The State agency technical contact who will release the data or oversee the release, and who is responsible for ensuring the required disclosure tracking takes place.
What goes in the process description?
The form asks for a brief description of the process the State will use to account for disclosures of individually identifiable information from the SOR.
Is there a separate mailing address for the form?
No. The form says it is attached to the Data Use Agreement request, and the CMS address on it is for comments on the time estimate.