NOTE - CMS will not accept requests which have been uploaded and encrypted to a third-party vendor site. If you wish to protect the documents from unauthorized disclosure, you probably already have the capability to password protect or encrypt your documents using your operating software compression utility (e.g. WINzip) or your desktop software (e.g. MS-Office). Refer to your organization's information technology (IT) support services for assistance.
The forms listed below are associated with the CMS Privacy program and Data Use Agreement (DUA) procedures. Some additional forms may be required for researcher data requests.
Researchers - all DUA requests from researchers for new data, requests to add data to an existing DUA or re-use data, must be processed and submitted to CMS via our Researcher Data Assistance Center, ResDAC, a CMS contractor that provides free assistance to anyone interested in using Medicare and/or Medicaid data. Contact ResDAC via:
All requests for DUA actions must be submitted to CMS via e-mail. Any forms must be signed, scanned and attached to the e-mail and sent to DataUseAgreement@cms.hhs.gov.
- Unless specifically directed otherwise, send requests only to DataUseAgreement@cms.hhs.gov
- Scanned documents are preferred to be file type .pdf
- Submit one (1) DUA request per e-mail
- Addendum forms for a new DUA may all be submitted together with the DUA request in one (1) e-mail
- Submit contact information updates separately from DUA extension requests
E-mail Subject Lines:
|Request Type (note 1)||Subject Line (do not include parenthesis)|
|New DUA (note 2)||New DUA (organization/researcher name or DSH provider #)|
|Add files (DUA Update form) to existing DUA (note 2)||DUA ##### Update|
|Requester change or add Custodian(s)/Recipient(s)||DUA ##### Addendum|
|Researcher DUA amendment (note 3)||DUA ##### Amendment|
|Extension||DUA ##### Extension|
|Closure||DUA ##### Closure|
|Remove Custodian(s)/Recipient(s)||DUA ##### Remove contacts|
|Change federal contact||DUA ##### Federal contact change|
|Replace CMS contact on all currently open DUAs||CMS Contact (name) global replacement|
|Correct contact information||Contact (name) information update|
Note 1: except to close a DUA, all CMS contracts and federal contracts/grants must be submitted through the federal contact for that specific DUA
Note 2: researchers must submit via ResDAC
Note 3: for DUAs that are not yet created, replace DUA ##### with organization/researcher name
CMS Contractors must submit all DUA associated requests (except closures) through their CMS Contract Officer Representative (COR) or Government Task Lead (GTL)
CMS DUA Forms
DUA Form-0235 to request Personally Identifiable Information (PII) from a CMS Privacy Act System of Records (SOR), with the exception of:
- Adding new data to a currently open DUA - use the Update Form CMS-0235u
- Limited Data Sets (LDS) - use the LDS Form-0236
- Disproportionate Share Hospital (DSH) data - use the DSH Form-0235d or the DSH Form-0235d2 as applicable
- State and Territory requests for the Enrollment Database (EDB) State Customized file - use the EDB State Form-0235st
DUA LDS Form-0235L for files derived from CMS Privacy Act Systems of Records
DUA LDS Attachment B Form (PDF) to request the LDS SAF NPI/UPIN Crosswalk
DUA DSH Form-0235d1 for Cost Reporting Periods Prior to December 8, 2004
DUA DSH Form-0235d2 for Cost Reporting Periods Including December 8, 2004 and Thereafter
DUA EDB State Form-0235st to request the EDB customized State file (for States/Territories only)
DUA Addendum Form-0235a to request an additional individual to be listed on the DUA.
DUA Update Form-0235u to request additional data descriptions to be added to a DUA.
DUA Certification of Disposition Form-10252 to request closure of a CMS DUA