DEPARTMENT OF HEALTH AND HUMAN SERVICES CENTERS FOR MEDICARE & MEDICAID SERVICES INSTRUCTIONS FOR COMPLETING THE DATA USE AGREEMENT (DUA) FORM CMS-R-0235 (AGREEMENT FOR USE OF CENTERS FOR MEDICARE & MEDICAID SERVICES (CMS) DATA CONTAINING INDIVIDUAL IDENTIFIERS) This agreement must be executed prior to the disclosure of data from CMS' Systems of Records to ensure that the disclosure will comply with the requirements of the Privacy Act, the Privacy Rule and CMS data release policies. It must be completed prior to the release of, or access to, specified data files containing protected health information and individual identifiers. Directions for the completion of the agreement follow: DO NOT ALTER the language contained in this agreement. � First paragraph, enter the Requestor's Organization Name. � Section #1, enter the Requestor's Organization Name. � Section #4, enter the Custodian Name, Company/Organization, Address, Phone Number (including area code), and E-Mail Address (if applicable). The Custodian of files is defined as that person who will have actual possession of and responsibility for the data files. This section should be completed even if the Custodian and Requestor are the same. � Section #5 will be completed by a CMS representative. � Section #6 enter the Study and/or Project Name and CMS contract number if applicable for which the file(s) will be used. � Section #7 should delineate the files and years the Requestor is requesting. Specific file names should be completed. If these are unknown, you may contact a CMS representative to obtain the correct names The System of Record (SOR) should be completed by the CMS contact or Project Officer. The SOR is the source system the data came from. � Section #8, complete by entering the Study/Project's anticipated date of completion. � Section #15 will be completed by CMS. � Section #19 is to be completed by Requestor. � Section #20 is to be completed by Custodian. � Section #21 will be completed by a CMS representative. � Section #22 should be completed if your study is funded by one or more other Federal Agencies. The Federal Agency name (other than CMS) should be entered in the blank. The Federal Project Officer should complete and sign the remaining portions of this section. If this does not apply, leave blank. � Sections #23a AND 23b will be completed by a CMS representative. � Addendum, CMS-R-0235A, should be completed when additional custodians outside the requesting organization will be accessing CMS identifiable data. Once the DUA is received and reviewed for privacy and policy issues, a completed and signed copy will be sent to the Requestor and CMS Project Officer, if applicable, for their files. Form CMS-R-0235 (11/05) EF 11/2005 American LegalNet, Inc. www.USCourtForms.com 1 DEPARTMENT OF HEALTH AND HUMAN SERVICES CENTERS FOR MEDICARE & MEDICAID SERVICES Form Approved OMB No. 0938-0734 DATA USE AGREEMENT DUA # AGREEMENT FOR USE OF CENTERS FOR MEDICARE & MEDICAID SERVICES (CMS) DATA CONTAINING INDIVIDUAL-SPECIFIC INFORMATION) In order to secure data that reside in a CMS Privacy Act System of Records; in order to ensure the integrity, security, and confidentiality of information maintained by the CMS; and to permit appropriate disclosure and use of such data as permitted by law, CMS and _________________________________________________ (Requestor) enter into this agreement to comply with the following specific paragraphs. 1. This Agreement is by and between the Centers for Medicare & Medicaid Services (CMS), a component of the U.S. Department of Health and Human Services (HHS), and _____________________________ _____________________________________________, hereinafter termed "User." (Requestor) 2. This Agreement addresses the conditions under which CMS will disclose and the User will obtain, use, reuse and disclose the CMS data file(s) specified in section 7 and/or any derivative file(s) that contain direct individual identifiers or elements that can be used in concert with other information to identify individuals. This Agreement supersedes any and all agreements between the parties with respect to the use of data from the files specified in section 7 and preempts and overrides any instructions, directions, agreements, or other understanding in or pertaining to any grant award or other prior communication from the Department of Health and Human Services or any of its components with respect to the data specified herein. Further, the terms of this Agreement can be changed only by a written modification to this Agreement or by the parties adopting a new agreement. The parties agree further that instructions or interpretations issued to the User concerning this Agreement or the data specified herein, shall not be valid unless issued in writing by the CMS point-of-contact specified in section 5 or the CMS signatory to this Agreement shown in section 23. 3. The parties mutually agree that CMS retains all ownership rights to the data file(s) referred to in this Agreement, and that the User does not obtain any right, title, or interest in any of the data furnished by CMS. 4. The parties mutually agree that the following named individual is designated as Custodian of the file(s) on behalf of the User and will be the person responsible for the observance of all conditions of use and for establishment and maintenance of security arrangements as specified in this Agreement to prevent unauthorized use. The User agrees to notify CMS within fifteen (15) days of any change of custodianship. The parties mutually agree that CMS may disapprove the appointment of a custodian or may require the appointment of a new custodian at any time. Name of Custodian Company/Organization Street Address City Office Telephone (Include Area Code) State ZIP Code E-Mail Address (If applicable) Form CMS-R-0235 (11/05) EF 11/2005 American LegalNet, Inc. www.USCourtForms.com 2 5. The parties mutually agree that the following named individual will be designated as point-of-contact for the Agreement on behalf of CMS. Name of Contact Title/Component Street Address City Office Telephone (Include Area Code) State ZIP Code E-Mail Address (If applicable) Mail Stop 6. The User represents, and in furnishing the data file(s) specified in section 7 CMS relies upon such representation, that such data file(s) will be used solely for the following purpose(s). Name of Study/Project CMS Contract No. (If applicable) The User represents further that the facts and st