DEPARTMENT OF HEALTH AND HUMAN SERVICES
CENTERS FOR MEDICARE & MEDICAID SERVICES
INSTRUCTIONS FOR COMPLETING THE DATA USE AGREEMENT (DUA) FORM CMS-R-0235
(AGREEMENT FOR USE OF CENTERS FOR MEDICARE & MEDICAID SERVICES (CMS)
DATA CONTAINING INDIVIDUAL IDENTIFIERS)
This agreement must be executed prior to the disclosure of data from CMS’ Systems of Records to ensure that
the disclosure will comply with the requirements of the Privacy Act, the Privacy Rule and CMS data release
policies. It must be completed prior to the release of, or access to, specified data files containing protected
health information and individual identifiers.
Directions for the completion of the agreement follow:
Before completing the DUA, please note the language contained in this agreement cannot be altered in
any form.
• First paragraph, enter the Requestor’s Organization Name.
• Section #1, enter the Requestor’s Organization Name.
• Section #4 enter the Study and/or Project Name and CMS contract number if applicable for which the
file(s) will be used.
• Section #5 should delineate the files and years the Requestor is requesting. Specific file names should be
completed. If these are unknown, you may contact a CMS representative to obtain the correct names
The System of Record (SOR) should be completed by the CMS contact or Project Officer. The SOR is
the source system the data came from.
• Section #6, complete by entering the Study/Project’s anticipated date of completion.
• Section #12 will be completed by the User.
• Section #16 is to be completed by Requestor.
• Section #17, enter the Custodian Name, Company/Organization, Address, Phone Number (including area
code), and E-Mail Address (if applicable). The Custodian of files is defined as that person who will have
actual possession of and responsibility for the data files. This section should be completed even if the
Custodian and Requestor are the same. This section will be completed by Custodian.
• Section #18 will be completed by a CMS representative.
• Section #19 should be completed if your study is funded by one or more other Federal Agencies. The
Federal Agency name (other than CMS) should be entered in the blank. The Federal Project Officer
should complete and sign the remaining portions of this section. If this does not apply, leave blank.
• Sections #20a AND 20b will be completed by a CMS representative.
• Addendum, CMS-R-0235A, should be completed when additional custodians outside the requesting
organization will be accessing CMS identifiable data.
Once the DUA is received and reviewed for privacy and policy issues, a completed and signed copy will be
sent to the Requestor and CMS Project Officer, if applicable, for their files.
1
Form CMS-R-0235 (06/10)