Data Available to CMS Contractors
CMS Contractors may require access to CMS data to conduct their contracted work. Access to data containing controlled unclassified information by CMS Contractors requires a data use agreement (DUA) with CMS. The DUA ensures contractor compliance with various laws, regulations, and CMS policies. It also creates a traceable record of the data files being accessed by each CMS Contractor.
Contractor DUA requests are submitted via CMS’ data disclosure tracking system, EPPE. CMS Contractors must adhere to all policies in the Contractor DUA Terms and Conditions (PDF) at all times.
CMS CORs and contractors may submit questions about Contractor DUAs or the process for requesting files to datauseagreement@cms.hhs.gov.
How to get started submitting a Contractor DUA:
CMS COR registers for the CMS Contact (COR) role in the EPPE system. See more information in the “Register for EPPE” section below.
CMS Contractor registers for the “DUA Requester” role in the EPPE system. See more information in the “Register for EPPE” section below.
CMS Contractor completes the required forms. See more information in the “Forms” section below.
CMS Contractor (DUA Requester) creates and submits the DUA Request in EPPE. Use the training modules below for assistance with this step.
CMS COR reviews and approves the DUA Request. Use the training modules below for assistance with this step.
CMS DUA Management Team reviews the DUA Request and provides a response within 3 business days.
CMS Contractor works with their CMS COR to get access to the CMS data listed on the DUA.
- Register for EPPE
To make a Contractor DUA request, please refer to the EPPE registration instructions and training materials below. CMS CORs and contractors are required to complete two trainings before accessing EPPE for the first time. Users will need to attest to completing the training when registering for EPPE roles.
Role
Title
Description
PDF
All Roles
EPPE User Registration
This training covers how to register for EPPE through CMS’ Identity Management system (IDM)
Requester
(Contractor)Training #1: Requesting the DUA Requester Role in EPPE
This training covers how an IDM registered user can request the DUA Requester Role in EPPE.
Training #2: Contractor Approval Workflow: DUA Requester
This training covers Contractor DUA features and other functions that users with the DUA Requester role can perform in the EPPE system.
CMS Contact
(CMS COR)Training #1: Requesting the CMS Contact (COR) Role in EPPE
This training covers how an IDM registered user can request the CMS Contact (COR) Role in EPPE.
Training #2: Contractor Approval Workflow: CMS Contact (COR)
This training covers Contractor DUA features and other functions that users with the CMS Contact (COR) role can perform in the EPPE system.
- How to Create a Contractor DUA
The training module below provides instructions on how to create a new Contractor DUA in EPPE.
Creating a Contractor DUA
New DUA Request with New Data Files
- How to Update and Manage a Contractor DUA
Training Materials for Requesters
The training modules below provides instructions on how Requesters can update and manage an existing Contractor DUA in EPPE.
Updating/ Amending a Contractor DUA (Requesters)
Update/Amend Main Information
Update/Amend COR on a Contractor DUA
Update/Amend Subcontracting Organization(s)
Update/Amend Custodians
Update/Amend Existing Data Files
Update/Amend New Data Files
EPPE DUA Management
Request to Change Requester
Request to Change Organization
DUA Requester Queues
Upload Supporting Documents
Print Contractor DUA
Requesting Additional Roles
Removing a Role
Requester Proxy Assignment
Requester DUA Search
Training Materials for CORsThe training modules below provides instructions on how CORs can update and manage an existing Contractor DUA in EPPE.
COR DUA Management
Approve an Update Request to a DUA
Deny an Update Request to a DUA
Request More Information for an Update Request to a DUA
Approve an Extension Request to a DUA
Deny an Extension Request to a DUA
Requesting Additional Roles
Removing a Role
COR Proxy Assignment
COR DUA Search
Print Contractor DUA
- How to Extend or Close a Contractor DUA
Extensions and Closures
Extend Contractor DUA
Closing a Contractor DUA
Close Select Data Files on a Contractor DUA
- Forms
Contractor DUA Signature Addendum (PDF) : Used when adding or updating a Data Custodian, Data Recipient, or Direct Access data user on a Contractor DUA.
Certificate of Disposition (COD) (PDF) : Used to close files on a DUA or close the entire DUA