The Centers for Medicare & Medicaid Services (CMS) Data Use Agreements (DUAs) may only be approved for a period of up to one year. After one year, the DUA will expire unless the DUA requester either extends or closes the DUA. If a DUA for an organization expires, it is important to note that ALL open DUAs for that organization will be frozen. This means that no new DUAs or actions on existing DUAs (e.g., adding data or changing contacts) will be processed for any DUAs held by that organization until the expired DUA is either extended or closed.
The DUA system will send the DUA contacts (requester, custodians, additional contacts and COR) notification e-mails at the following intervals, before the DUA expires: 60 days, 30 days, 15 days, and every day thereafter.
- Extending or Closing a Contractor DUA
-
CMS contractors are required to process DUA requests in EPPE. Please see the Contractor web page for instructions on how to extend/close DUAs.
- Extending or Closing a Limited Data Set (LDS) DUA
-
LDS requesters are required to process DUA requests in EPPE. Please see the LDS web page for instructions on how to extend/close DUAs.
- Extending a Researcher DUA
-
ALERT: Starting on April 24, 2023, requests to extend a Research DUA with physically shipped data will require an approved Data Management Plan Self-Attestation Questionnaire (DMP SAQ). If your DUA is not extended or closed by the expiration date, your DUA status will change to “expired.” If your DUA status is “expired” for 30 days, your organization will be in violation of the terms of the DUA. At this point, you and all other researchers associated with your organization will be required to close all DUAs. Researchers at organizations that have violated the terms of the DUA because the organization has not complied with the DMP SAQ requirement will be prohibited from requesting a research DUA with physically shipped CMS data indefinitely. The DMP SAQ requirement does not apply to DUAs where researchers are only accessing data in the Chronic Conditions Warehouse Virtual Research Data Center, Limited Data Set DUAs, or Contractor DUAs. For more information, please see: https://resdac.org/cms-news/updated-research-request-forms-and-data-security-approval-required-beginning-42423
DUAs can only be extended within 60 calendar days of the DUA Expiration Date. Only the requester or data custodian/additional contact (if they include the requester on the email) may initiate a request to extend a DUA.
Instructions:
The requester, custodian, or additional contact listed on the DUA drafts an email with the following information:
- Email Subject: “Request to extend DUA [your DUA number]”
- Email Body: The body of the email should include the following:
- We are still using this data as originally requested for our Project/Study. In accordance with the terms and conditions of the DUA, we understand that the data for this DUA may not be used in any form, or for any additional work, outside the scope of this DUA without the expressed written consent of CMS.
- I have reviewed the contact information on the DUA and submitted necessary updates to DataUseAgreement@cms.hhs.gov for processing.
- We request a one (1) year [or less, if applicable] extension for the DUA number listed in the subject of this e-mail.
- Closing a Researcher DUA
-
Only the requester or data custodian may sign the Certificate of Disposition (COD) form to close a DUA.
Required forms:
Certificate of Disposition (PDF)If the requester is no longer with the organization, an appropriate contact from the requester’s organization may submit the request with the following text included within the request: “The requester listed on the DUA is no longer associated with the organization(s) listed on this DUA."
Instructions:
The requester, custodian, or additional contact listed on the DUA drafts an email with the following information:- Email Subject: “Request to close DUA [your DUA number]”
- Email Attachment: The completed and signed Certificate of Disposition