Contact Changes

Contact changes to a Data Use Agreement (DUA) include adding or removing a person or organization listed on the DUA.

• Requester – The person authorized to legally bind their organization (known as the "Requesting Organization") to the terms specified in the DUA. This is a required role on the DUA.
• Data Custodian – Individual who will be responsible for ensuring that the environment in which the CMS data is stored complies with all applicable CMS data security requirements, including the establishment and maintenance of security arrangements to prevent unauthorized use.
• Additional Contact(s) - An Additional Contact is an individual that is involved in the research study. An individual listed as an additional contact will receive notifications about the DUA and will be able to perform certain DUA functions.
• Subcontracting/Collaborating Organization – A collaborating organization works with the requesting organization, will have access to individual-level data and will actively participate in the study. Subcontractors are considered collaborating organizations and should be identified as such.

Please Note: For information on making changes to a Data Management Plan Self-Attestation Questionnaire (DMP SAQ), please visit ResDAC’s DMP SAQ page.

Contact Changes for CMS Sponsored Programs and Oversight Agencies

Instructions:

The requester listed on the DUA drafts an email with the following information:

1. Email Subject: “Request to update contacts on DUA [your DUA number]”
2. Email Body: To remove/add/change a contact, state “Please remove/add/change [contact name(s)].”

The requester listed on the DUA sends the email to:

1. For Participants in a CMS Sponsored Program: Your CMS contact/federal project officer must be carbon copied (CC) on the email sent to the DUA mailbox: DataUseAgreement@cms.hhs.gov ; or
2. For Oversight Agencies: The DUA mailbox: DataUseAgreement@cms.hhs.gov.

 

Contact Changes for CMS Contractor and Limited Data Set (LDS) DUAs

CMS contractors and LDS requesters are required to process DUA requests in EPPE. Please see the Contractor web page or the LDS web page for instructions on performing contact changes. 

---

Organization name/contact information updates for CMS Contractor and Limited Data Set (LDS) DUAs

Please Note: These instructions are for LDS and Contractor DUAs only.  For Research DUAs, this action must be processed through ResDAC (www.resdac.org).

Instructions:

1. The requester, custodian, or additional contact listed on the DUA drafts an e-mail with the following information:
   1. Email Subject: “Request to update organization information on DUA [your DUA number]”
   2. Email Body/Attachment: For updates to an organization name, you must provide proof of the organization name change (e.g., web site link or announcement on company letterhead). We will only change the organization name under these circumstances. Otherwise, a new DUA will be required. To update contact information, list the requested changes.
2. Send the email to the DUA Mailbox DataUseAgreement@cms.hhs.gov.  If a custodian or additional contact is sending the email, they must carbon copy (CC) the requester listed on the DUA.

Contact Changes for Research DUAs

Instructions for the various contact changes are outlined below. Only the requester listed on the DUA or data custodian/additional contact listed on the DUA (if they include the requester on the email) may initiate a contact change.

Multiple requests for the same DUA can be sent in one email. For requests that apply to more than one DUA, please send one email for each unique DUA.

---

Change the Requester/Update Requester Contact Information on a DUA

CMS must be notified if there is a change in your organization’s requester. If the only change you are making is to change the requester on a DUA or update the contact information for the current requester on a DUA, the change can be sent directly to CMS. If you are making additional changes to your DUA (e.g., adding new data files), please contact ResDAC with your full amendment request.

Required forms:

• RIF Data Use Agreement (DUA): Amendment Request (Required for a requester change)
• Key Personnel Supplement

Instructions:

The current requester listed on the DUA drafts an email with the following information:

1. Email Subject: “Request to [change Requester/update requester contact information] on DUA [your DUA number]”
2. Email Attachment: The signed Amendment form (signed by the new requester, only required for requester change) and completed Key Personnel Supplement (with new/updated requester contact information)

The requester listed on the DUA sends the email to the DUA mailbox: DataUseAgreement@cms.hhs.gov

If the current requester listed on the DUA is no longer available, please contact the DataUseAgreement@cms.hhs.gov mailbox for assistance.

---

Change the Data Custodian or Update Data Custodian Contact Information on a DUA

CMS must be notified if there is a change in your organization’s data custodian or the data custodian’s contact information. For physical data requests, CMS requires only one data custodian per hosting environment who is responsible for all users with access to the data. For Virtual Research Data Center (VRDC) data requests, no data custodian is required.

If you have a Data Management Plan Self-Attestation Questionnaire (DMP SAQ), contact the Data Privacy Safeguard Program (DPSP) team to request updates to the data custodian at data_privacy_safeguard_program@mbltechnologies.com.

If you have not yet transitioned to a DMP SAQ , contact ResDAC for guidance.

---

Add/Update/Remove Additional Contacts on a DUA

Every DUA requires at least one and no more than three additional contacts. Additional contacts may be changed at any time.

Required forms:

Key Personnel Supplement 

Instructions:

The current requester listed on the DUA drafts an email with the following information:

1. Email Subject: “Request to [add/update/remove additional contacts] on DUA [your DUA number]”

2. Email Attachment:  The completed Key Personnel Supplement (with new add/update/remove additional contacts on DUA

The requester listed on the DUA sends the email to the DUA mailbox: DataUseAgreement@cms.hhs.gov

---

Add or Remove a collaborating/sub-contracting organization

You must notify CMS before adding or removing a new collaborating organization on your project. To add or remove a collaborating organization, please contact ResDAC.

---

Update an organization name/contact information

You must notify CMS on organization name changes and updates to contact information.  To make organization name and contact information updates, please contact ResDAC.