Skip to Main Content

Contact Changes

Contact changes to a Data Use Agreement (DUA) include adding or removing a person listed on the DUA. There are three roles on a DUA: 

  • Requestor – The person most responsible for the data used under the DUA; usually this is the person who initially opened the DUA. This is a required role on the DUA.
  • Custodian(s) – Individuals who will have actual possession of the CMS data files, and who will be responsible for observance of all conditions of use, including the establishment and maintenance of security arrangements to prevent unauthorized use. This is a required role on the DUA, but may be the same individual as the Requestor.
  • Subcontracting/Collaborating Organization – An organization that is subcontracting or collaborating with the Requestor’s organization and has individuals that need access to CMS data. Only the Subcontracting or Collaborating organization will be added, not individuals. This is an optional role on the DUA.

Only the Requestor or Custodian (if they include the Requestor on the request) may initiate a request to make contact changes. The only exception is if both the Requestor and the Custodian(s) are no longer with the organization. In this case, an appropriate contact from the Requestor’s organization can submit the request with the following text: “All of the current individuals listed on the DUA (i.e., the Requestor/Custodians) are no longer associated with the organizations listed on this DUA." Requests to add or remove multiple individuals/organizations from a DUA may be submitted in one e-mail. However, if there are changes to more than one DUA, a new e-mail must be submitted for each DUA number. 

Adding an individual(s)/organization to a DUA

  1. The Requestor or Custodian completes the DUA Addendum form, including the following information:
    • DUA Number,
    • Study/Project Name,
    • Role of the new individual/organization,
    • Contact information
  2. Print, Sign, and Scan the DUA Addendum form
  3. Draft an email with the DUA number as the subject line
  4. Send the email to the following contact:
    1. If a CMS Contractor, CMS Sponsored Program Awardee/Grantee, or Federal Grantee, please submit the form to your CMS Contact or Federal project Officer
    2. All other organizations, please submit to DataUseAgreement@cms.hhs.gov  

Removing an individual(s)/organization from a DUA:

  1. The Requestor or Custodian drafts an email with the following information:
    • The name of the individual(s)/organizations you would like removed, and
    • Attesting that that those who are being removed have destroyed all data from the DUA in their possession. You must also verify that they do not possess any copies, derivatives, subsets, and/or manipulated files on:
      • (a) all computers in their possession, and
      • (b) those of their peers who had access to the data, but were not listed individually on the DUA. This requirement extends to physical and hardcopy versions of such data.
  2. Draft an email with the DUA number as the subject line
  3. Send the email to the following contact:
    1. If a CMS Contractor, CMS Sponsored Program Awardee/Grantee, or Federal Grantee, please submit the form to your CMS Contact or Federal project Officer
    2. All other organizations, please submit to DataUseAgreement@cms.hhs.gov

Want to receive the latest news and updates for EPPE & DUAs? Sign up for the EPPE GovDelivery Subscription here.