Extensions and Closures

The Centers for Medicare & Medicaid Services (CMS) Data Use Agreements (DUAs) may only be approved for a period of up to one year. After one year, the DUA will expire unless the DUA Requester either extends or closes the DUA. If a DUA for an organization expires, it is important to note that ALL open DUAs for that organization will be frozen. This means that no new DUAs or actions on existing DUAs (adding data or changing contacts) will be processed for any DUAs held by that organization until the expired DUA is either extended or closed. The DUA system will send the DUA contacts (Requester, Custodians, COR, Federal Project Officer (FPO), and Principal Investigators) notification e-mails at the following intervals, before the DUA expires: 60 days, 30 days, 15 days, and every day thereafter.

CMS Contractor DUAs

CMS Contractors are required to process DUA requests in EPPE. Please see the Contractor web page for instructions on how to Extend/Close DUAs.

Closing a Researcher RIF or LDS DUA

Only the Requester may sign the Certificate of Disposition (COD) form to close a DUA. The COD form may be submitted to the DataUseAgreement@cms.hhs.gov mailbox by the Requester or Custodian (if they include the Requester on the email). 

If the Requester is no longer with the organization, an appropriate contact, such as a Custodian from the Requester’s organization may submit the request with the following text included within the request: “The Requester listed on the DUA is no longer associated with the organization(s) listed on this DUA." 

  1. Complete and sign the COD Form (PDF).
  2. Draft an email with the subject “DUA <#> - Closure” and attach the signed form.
  3. Send the email to DataUseAgreement@cms.hhs.gov
  • If you are a CMS Sponsored Program, CMS Awardee, CMS Grantee, or Federal Grantee, please “cc” your CMS Contact or Federal Project Officer on the e-mail.

Extending a Researcher RIF or LDS DUA

Only the Requester or Custodian (if they include the Requester on the email) may initiate a request to extend a DUA. 

If the Requester and Custodians listed on the DUA are no longer with the organization, an appropriate contact from the Requester’s organization may submit the request with the following text within the request: “All of the current individuals listed on the DUA (i.e., the Requester/Custodians) are no longer associated with the organization(s) listed on this DUA."

  1. Draft an email with the subject line “DUA <#> - Extension” that includes the following:
    • We are still using this data as originally requested for our Project/Study. In accordance with the terms and conditions of the DUA, we understand that the data for this DUA may not be used in any form, or for any additional work, outside the scope of this DUA without the expressed written consent of CMS's DUA Team.
    • I have reviewed the contact information on the DUA and submitted necessary updates to DataUseAgreement@cms.hhs.gov for processing.
    • We request a one (1) year [or less, if applicable] extension for the DUA number listed in the Subject of this e-mail.
  2. Send the email to the following.
  • If a CMS Sponsored Program, CMS Awardee, CMS Grantee, or Federal Grantee, please e-mail the form to your CMS Contact or Federal Project Officer for them to submit on your behalf.
  • All other entities, please email the DataUseAgreement@cms.hhs.gov.
  • Note: Each DUA related request (Extensions, Contact changes, Additional Data) must be sent in a separate email.
Page Last Modified:
12/03/2019 03:54 PM