Extensions and Closures

The Centers for Medicare & Medicaid Services (CMS) Data Use Agreements (DUAs) may only be approved for a period of up to one year. After one year, the DUA will expire unless the DUA requester either extends or closes the DUA. If a DUA for an organization expires, it is important to note that ALL open DUAs for that organization will be frozen. This means that no new DUAs or actions on existing DUAs (e.g., adding data or changing contacts) will be processed for any DUAs held by that organization until the expired DUA is either extended or closed. 

The DUA system will send the DUA contacts (requester, custodians, additional contacts and COR) notification e-mails at the following intervals, before the DUA expires: 60 days, 30 days, 15 days, and every day thereafter.


CMS Contractor and Limited Data Set (LDS) DUAs

CMS contractors and LDS requesters are required to process DUA requests in EPPE. Please see the Contractor web page or the LDS web page for instructions on how to extend/close DUAs.


Closing a Researcher DUA

Only the requester or data custodian may sign the Certificate of Disposition (COD) form to close a DUA. 

Required forms:

Instructions:

  1. The requester, custodian, or additional contact listed on the DUA drafts an email with the following information:
    1. Email Subject: “Request to close DUA [your DUA number]”
    2. Email Attachment: The completed and signed Certificate of Disposition
  2. Send the email to the Data Use Agreement Mailbox DataUseAgreement@cms.hhs.gov. If the DUA is with a CMS Sponsored Program, CMS Awardee, CMS Grantee, or Federal Grantee, carbon copy (CC) your CMS contact or Federal Project Officer on the email.

If the requester is no longer with the organization, an appropriate contact from the requester’s organization may submit the request with the following text included within the request: “The requester listed on the DUA is no longer associated with the organization(s) listed on this DUA." 


Extending a Researcher DUA

DUAs can only be extended within 60 calendar days of the DUA Expiration Date. Only the requester or data custodian/additional contact (if they include the requester on the email) may initiate a request to extend a DUA. 

Instructions:

  1. The requester, custodian, or additional contact listed on the DUA drafts an email with the following information:
    1. Email Subject: “Request to extend DUA [your DUA number]”
    2. Email Body: The body of the email should include the following:
    • We are still using this data as originally requested for our Project/Study. In accordance with the terms and conditions of the DUA, we understand that the data for this DUA may not be used in any form, or for any additional work, outside the scope of this DUA without the expressed written consent of CMS.
    • I have reviewed the contact information on the DUA and submitted necessary updates to DataUseAgreement@cms.hhs.gov for processing.
    • We request a one (1) year [or less, if applicable] extension for the DUA number listed in the subject of this e-mail.
  2.  Send the email to the CMS Data Use Agreement Mailbox DataUseAgreement@cms.hhs.gov.  If a custodian or additional contact is sending the email, they must carbon copy (CC) the requester listed on the DUA. If the DUA is with a CMS Sponsored Program, CMS Awardee, CMS Grantee, or Federal Grantee, carbon copy (CC) your CMS contact or Federal Project Officer on the email.
Page Last Modified:
01/04/2023 02:25 PM