DEPARTMENT OF HEALTH AND HUMAN SERVICES CENTERS FOR MEDICARE & MEDICAID SERVICES INSTRUCTIONS FOR COMPLETING THE LIMITED DATA SET DATA USE AGREEMENT (DUA) (CMS-R-0235L) This Agreement is needed to ensure that the disclosure and use of Limited Data Sets derived from a CMS Privacy Act System of Records comply with the Privacy Act of 1974 (5 USC§522a) and the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule (45 CFR Parts 160 and 164). Directions for the completion of the agreement follow: Before completing the DUA, please note the language contained in this agreement cannot be altered in any form. A. First paragraph, enter the Requestor's/User's Organization Name. B. Section #1, enter the Requestor's/User's Organization Name. C. Section #3, enter the Custodian Name, Company/Organization, Address, Phone Number (including area code), and E-Mail Address (if applicable). The Custodian of the files (name and position/title) is defined as the person who will have actual possession of and responsibility for the limited data set files. This section should be completed even if the Custodian and Requestor/User are the same. D. Section #4 will be completed by a CMS representative. E. Section #5 should delineate the limited data set files and years of data the Requestor/User is requesting. Specific filenames should be specified. If these filenames are unknown, you may contact a CMS representative. F. Section #6 includes both a summary of the purpose and a detailed explanation of the research study or project. The detailed explanation describing your research purpose must be attached to the agreement. Attached to this Agreement are the Research Application Guidelines that should be followed in preparing your detailed explanation. CMS evaluates the purpose for which the limited data set file will be used to determine whether: 1) the purpose requires identifiable records; 2) the project is of sufficient importance to justify the risk on beneficiary privacy; 3) there is reasonable probability that the use of data will accomplish the purpose, i.e., the project is soundly designed; and 4) the purpose demonstrates the potential to improve the quality of life for Medicare beneficiaries or improve the administration of the Medicare program, including payment related projects. If the Research Application provided by the Requesting Organization contains proprietary information, a statement to that effect must be included in the Research Application submitted to CMS. Proprietary information is exempt from release under the Freedom of Information Act if it falls within the scope of Exemption 4, 5 U.S.C. § 552(b)(4). G. Section #8, complete by entering the completion date of the study or project. H. Section #16 is to be completed by the Requestor/User. I. Section #17 is to be completed by the Custodian. J. Section #18 will be completed by a CMS representative. K. Section #19 will be completed by a CMS representative. For assistance or questions in completing this Agreement, please contact the Division of Privacy Compliance Data Development Help Line at 410-786-3690. Form CMS-R-0235L (11/05) EF 11/2005 American LegalNet, Inc. www.USCourtForms.com 1 DEPARTMENT OF HEALTH AND HUMAN SERVICES CENTERS FOR MEDICARE & MEDICAID SERVICES Form Approved OMB No. 0938-0734 DATA USE AGREEMENT DUA # AGREEMENT FOR USE OF CENTERS FOR MEDICARE & MEDICAID SERVICES (CMS) LIMITED DATA SETS In order to ensure that the disclosure and use of Limited Data Sets derived from a CMS Privacy Act System of Records comply with the Privacy Act of 1974 (5 USC §522a) and the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule (45 CFR Parts 160 and 164), CMS and ________________ _________________________________________________ enter into this Agreement: 1. This Agreement is by and between the Centers for Medicare & Medicaid Services (CMS), a component of the U.S. Department of Health and Human Services (DHHS), and ____________________________ ________________________________________, hereinafter termed "User." 2. The parties mutually agree that CMS retains all ownership rights to the limited data set file(s) referred to in this Agreement, and that the User does not obtain any right, title, or interest in any of the data furnished by CMS. The parties further agree that CMS makes no representation or warranty, either implied or express, with respect to the accuracy of any data in the limited data set file(s). 3. The parties mutually agree that the following named individual is designated as Custodian of the limited data set file(s) on behalf of the User and the person shall oversee the observance of all conditions of use and the establishment and maintenance of security arrangements as specified in this Agreement to prevent unauthorized use. The User agrees to notify CMS within fifteen (15) days of any change of custodianship. The parties mutually agree that CMS may disapprove the appointment of a custodian or may require the appointment of a new custodian at any time. Name of Custodian Company/Organization Street Address City Telephone (Include Area Code) State ZIP Code E-Mail Address (If applicable) 4. The parties mutually agree that the following named individual is designated as point-of-contact for the Agreement on behalf of CMS. (To be completed by CMS staff.) Name of Contact Title/Component Street Address City Office Telephone (Include Area Code) Form CMS-R-0235L (11/05) EF 11/2005 Mail Stop State ZIP Code E-Mail Address (If applicable) American LegalNet, Inc. www.USCourtForms.com 2 5. The following CMS limited data set file(s) is/are covered under this Agreement. File Year(s) 6. The User represents that the limited data set files in section 5 above will be used solely for the following research purpose (provide a brief summary of the purpose below): In addition to the summary above, the User must provide a detailed explanation of the research purpose which is incorporated by reference into this Agreement. The research purpose must demonstrate the potential to improve the quality of life for Medicare beneficiaries or improve the administration of the Medicare program, including payment-related projects. The User represents further that the facts and statements made in this explanation are complete and accurate. Research Application Guidelines are attached as `Attachment A' and are incorporated by reference to this Agreement. 7. The User shall not attempt to identify or contac