NOTE - CMS will not accept requests which have been uploaded and encrypted to a third-party vendor site.  If you wish to protect the documents from unauthorized disclosure, you probably already have the capability to password protect or encrypt your documents using your operating software compression utility (e.g. WINzip) or your desktop software (e.g. MS-Office).  Refer to your organization's information technology (IT) support services for assistance.

The forms listed below are associated with the CMS Privacy program and Data Use Agreement (DUA) procedures.  Some additional forms may be required for researcher data requests.

Researchers - all DUA requests from researchers for new data, requests to add data to an existing DUA or re-use data, must be processed and submitted to CMS via our Researcher Data Assistance Center, ResDAC, a CMS contractor that provides free assistance to anyone interested in using Medicare and/or Medicaid data. Contact ResDAC via:

All requests for DUA actions must be submitted to CMS via e-mail.  Any forms must be signed, scanned and attached to the e-mail and sent to  

  1. Unless specifically directed otherwise, send requests only to
  2. Scanned documents are preferred to be file type .pdf
  3. Submit one (1) DUA request per e-mail
  4. Addendum forms for a new DUA may all be submitted together with the DUA request in one (1) e-mail
  5. Submit contact information updates separately from DUA extension requests

E-mail Subject Lines:

Request Type (note 1) Subject Line (do not include parenthesis)
New DUA (note 2) New DUA (organization/researcher name or DSH provider #)
Add files (DUA Update form) to existing DUA (note 2) DUA ##### Update
Requester change or add Custodian(s)/Recipient(s) DUA ##### Addendum
Researcher DUA amendment (note 3) DUA ##### Amendment
Extension DUA ##### Extension
Closure DUA ##### Closure
Remove Custodian(s)/Recipient(s) DUA ##### Remove contacts
Change federal contact DUA ##### Federal contact change
Replace CMS contact on all currently open DUAs CMS Contact (name) global replacement
Correct contact information Contact (name) information update

Note 1: except to close a DUA, all CMS contracts and federal contracts/grants must be submitted through the federal contact for that specific DUA

Note 2: researchers must submit via ResDAC 

Note 3: for DUAs that are not yet created, replace DUA ##### with organization/researcher name

CMS Contractors must submit all DUA associated requests (except closures) through their CMS Contract Officer Representative (COR) or Government Task Lead (GTL)


DUA Form-0235 to request Personally Identifiable Information (PII) from a CMS Privacy Act System of Records (SOR), with the exception of:

  1. Adding new data to a currently open DUA - use the Update Form CMS-0235u
  2. Limited Data Sets (LDS) - use the LDS Form-0236
  3. Disproportionate Share Hospital (DSH) data - use the DSH Form-0235d or the DSH Form-0235d2 as applicable
  4. State and Territory requests for the Enrollment Database (EDB) State Customized file - use the EDB State Form-0235st

DUA LDS Form-0235L for files derived from CMS Privacy Act Systems of Records 

DUA LDS Attachment B Form (PDF) to request the LDS SAF NPI/UPIN Crosswalk

DUA DSH Form-0235d1 for Cost Reporting Periods Prior to December 8, 2004

DUA DSH Form-0235d2 for Cost Reporting Periods Including December 8, 2004 and Thereafter 

DUA EDB State Form-0235st to request the EDB customized State file (for States/Territories only) 

DUA Addendum Form-0235a to request an additional individual to be listed on the DUA.

DUA Update Form-0235u to request additional data descriptions to be added to a DUA.

DUA Certification of Disposition Form-10252 to request closure of a CMS DUA 

Page Last Modified:
01/23/2019 04:16 PM