Contractors

The Centers for Medicare & Medicaid Services (CMS) employs contractors to provide a wide range of services and makes data available to these contractors as needed to support their assigned work. A CMS Data Use Agreement (DUA) is used to create a traceable record of what data is being accessed by each CMS contractor.   All CMS contractors requiring access to PHI/PII as well as their Contracting Officer Representatives (CORs) must create and maintain their CMS DUAs through the Enterprise Privacy Policy Engine (EPPE) system. Prior to gaining access to the EPPE system, contractors and CORS must complete EPPE training as outlined in the tables below.  

Important DUA reminders:

Contact Changes

The DUA Addendum form (PDF) is still required in the EPPE process. While the Requester now adds individuals to a DUA directly in EPPE, CMS still needs a signed copy of the DUA Addendum form (PDF) for legal purposes.

For instructions on how to process a contact change in EPPE, please see the Requester (Contractor) Training titled “Update/Amend – Custodian(s)/DESY User(s)” below.

DUA Closures

Requesters should process DUA closures in EPPE by following the Requester (Contractor) Training titled “Extend/Close DUA” below. However, if closing your DUA is your only remaining DUA action and you have no other DUAs in EPPE, you can send your completed CMS DUA Certificate of Disposition (COD form) (PDF) to DataUseAgreement@cms.hhs.gov and the CMS DUA Team will close your DUA for you. Please be sure to “cc” your CMS Contact on the e-mail.

Contractor Workflow: Initial - Training Materials

CMS CORs and contractors are required to complete two trainings before accessing EPPE for the first time. Training materials are available as either a YouTube video or PDF slide deck. Users will need to attest to completing the training when registering for EPPE roles.

Role Title Description YouTube PDF
Requester
(Contractor)
Training #1: Requesting EPPE User Role This training covers how an EIDM registered user can request the EPPE User Role. Link Download (PDF)
Training #2: Contractor Approval Workflow: DUA Requester This training covers Contractor DUA features and other functions that users with the DUA Requester role can perform in the EPPE system. Link Download (PDF)
CMS Contact 
(CMS COR)
Training #1: Requesting EPPE User Role This training covers how an EIDM registered user can request the EPPE User Role. Link Download (PDF)
Training #2: Contractor Approval Workflow: CMS Contact (COR) This training covers Contractor DUA features and other functions that users with the CMS Contact (COR) role can perform in the EPPE system. Link Download (PDF)

Contractor Workflow: Refresher Training Materials

The training modules below provide a refresher on performing specific actions in EPPE.

Role Title YouTube PDF

Requester
(Contractor)

Requesting EPPE DUA Requester Role, Attestation & DUA Re-Assignment Link Download (PDF)
Change Contact & Ad Hoc Requests Link Download (PDF)
New/Re-Use DUA with Re-Use Data Files Link Download (PDF)
Update/Amend - Main Information Link Download (PDF)
Update/Amend – Sub-Contracting Organization(s) Link Download (PDF)
Update/Amend – Custodian(s)/DESY User(s) Link Download (PDF)
Update/Amend – New & Re-use Data Files Link Download (PDF)
Update/Amend - Existing Data Files & Upload Documents Link Download (PDF)
Extend/Close DUA Link Download (PDF)
DUA Search & Manage Access Link Download (PDF)
CMS Contact (COR) Requesting EPPE CMS Contact (COR) Role Link Download (PDF)
DUA Re-Assignment Link Download (PDF)
Create/Update DUA Link Download (PDF)
DUA Search & Manage Access Link Download (PDF)

 

Who do I contact if I need help with EPPE?

If you need assistance with EPPE, please review the EPPE FAQs (PDF).  If you are unable to find the answer to your question, contact the EPPE Help Desk at 844-EPPE-DUA (844-377-3382) or EPPE@cms.hhs.gov

Page Last Modified:
06/03/2019 08:38 AM