Contractors

The Centers for Medicare & Medicaid Services (CMS) employs contractors to provide a wide range of services and makes data available to these contractors as needed to support their assigned work. A CMS Data Use Agreement (DUA) is used to create a traceable record of what data is being accessed by each CMS contractor. You must adhere to all policies in the Contractor DUA Terms and Conditions (PDF) at all times.  All CMS contractors requiring access to PHI/PII as well as their Contracting Officer Representatives (CORs) must create and maintain their CMS DUAs through the Enterprise Privacy Policy Engine (EPPE) system. Prior to gaining access to the EPPE system, contractors and CORS must complete EPPE training as outlined in the tables below.  

Important DUA reminders:

Contact Changes

The DUA Addendum form (PDF) is still required in the EPPE process. While the Requester now adds individuals to a DUA directly in EPPE, CMS still needs a signed copy of the DUA Addendum form (PDF) for legal purposes.

For instructions on how to process a contact change in EPPE, please see the Requester (Contractor) Training titled “Update/Amend – Custodians” below.

DUA Closures

Requesters should process DUA closures in EPPE by following the Requester (Contractor) Training titled “Extend/Close DUA” below. However, if closing your DUA is your only remaining DUA action and you have no other DUAs in EPPE, you can send your completed CMS DUA Certificate of Disposition (COD form) (PDF) to DataUseAgreement@cms.hhs.gov and the CMS DUA Team will close your DUA for you. Please be sure to “cc” your CMS Contact on the e-mail.

Contractor Workflow: Initial - Training Materials

CMS CORs and contractors are required to complete two trainings before accessing EPPE for the first time. Training materials are available as a PDF slide deck. Users will need to attest to completing the training when registering for EPPE roles.

Contractor Workflow: Refresher Training Materials for Requesters

The training modules below provide a refresher on performing specific actions in EPPE.

Contractor Workflow: Refresher Training Materials for CORs

The training modules below provide a refresher on performing specific actions in EPPE.

Who do I contact if I need help with EPPE?

If you need assistance with EPPE, please review the EPPE FAQs (PDF).  If you are unable to find the answer to your question, contact the EPPE Help Desk at 844-EPPE-DUA (844-377-3382) or EPPE@cms.hhs.gov