Contact Changes

Contact changes to a Data Use Agreement (DUA) include adding or removing a person or organization listed on the DUA.

• Requester – The person authorized to legally bind their organization (known as the "Requesting Organization") to the terms specified in the DUA. This is a required role on the DUA.
• Data Custodian – Individual who will be responsible for ensuring that the environment in which the CMS data is stored complies with all applicable CMS data security requirements, including the establishment and maintenance of security arrangements to prevent unauthorized use.
• Data Recipient - Individual under the oversight of the Data Custodian who takes possession of CMS data via physical shipment or download.
• Direct Access - Individual with direct access to CMS data through CMS systems. This individual must not download any restricted data unless approved to do so by CMS and listed as a Data Recipient on the DUA.
• Additional Contact(s) - An Additional Contact is an individual that is involved in the research study. An individual listed as an additional contact will receive notifications about the DUA and will be able to perform certain DUA functions.
• Subcontracting/Collaborating Organization – A collaborating organization works with the requesting organization, will have access to individual-level data and will actively participate in the study. Subcontractors are considered collaborating organizations and should be identified as such.

Please Note: For information on making changes to a Research Identifiable File (RIF) DUA, please visit ResDAC’s Managing Your Project page. For information on making changes to a RIF DUA Data Management Plan Self-Attestation Questionnaire (DMP SAQ), please visit ResDAC’s DMP SAQ page.

Contact Changes for CMS Sponsored Programs and Oversight Agencies

Instructions:

The requester listed on the DUA drafts an email with the following information:

1. Email Subject: “Request to update contacts on DUA [your DUA number]”
2. Email Body: To remove/add/change a contact, state “Please remove/add/change [contact name(s)].”

The requester listed on the DUA sends the email to:

1. For Participants in a CMS Sponsored Program: Your CMS contact/federal project officer must be carbon copied (CC) on the email sent to the DUA mailbox: DataUseAgreement@cms.hhs.gov ; or
2. For Oversight Agencies: The DUA mailbox: DataUseAgreement@cms.hhs.gov.

Contact Changes for CMS Contractor and Limited Data Set (LDS) DUAs

CMS contractors and LDS requesters are required to process DUA requests in EPPE. Please see the Contractor web page or the LDS web page for instructions on performing contact changes. 

---

Organization name/contact information updates for CMS Contractor and Limited Data Set (LDS) DUAs

Please Note: These instructions are for LDS and Contractor DUAs only.  For Research DUAs, this action must be processed through ResDAC (www.resdac.org).

Instructions:

1. The requester, custodian, or additional contact listed on the DUA drafts an e-mail with the following information:
   1. Email Subject: “Request to update organization information on DUA [your DUA number]”
   2. Email Body/Attachment: For updates to an organization name, you must provide proof of the organization name change (e.g., web site link or announcement on company letterhead). We will only change the organization name under these circumstances. Otherwise, a new DUA will be required. To update contact information, list the requested changes.
2. Send the email to the DUA Mailbox DataUseAgreement@cms.hhs.gov.  If a custodian or additional contact is sending the email, they must carbon copy (CC) the requester listed on the DUA.

Contact Changes for Research DUAs

For information on making changes to a Research Identifiable File (RIF) DUA, please visit ResDAC’s Managing Your Project page. For information on making changes to a RIF DUA Data Management Plan Self-Attestation Questionnaire (DMP SAQ), please visit ResDAC’s DMP SAQ page.