Data Use Agreement Instructions

When and How to File a DUA Addendum
ACOs with a July 1, 2019 start date have not been assigned DUA numbers yet. These ACOs will have the ability to make changes
to their DUA when they have their DUA number. These ACOs should be assigned DUA numbers shortly and then can follow the
below instructions should they need to make a change to their DUA. The DUA governs the release of, or access to, specified data
files containing protected health information and individual identifiers.

If your ACO plans to share covered data (in a manner permissible by the terms of the DUA) outside of your organization or if it
needs to add personnel to the DUA, then you must submit a DUA Addendum. Specifically, if your ACO meets any of the following
five circumstances, you must complete and submit a DUA Addendum:

If your ACO plans to share covered data (in a manner permissible by the terms of the DUA) outside of your organization. For
example, if your ACO intends to work with a third party and share data obtained from CMS through the Shared Savings
Program, it must complete and submit a DUA Addendum.

  • If your DUA requestor has changed.

  • If you only have one DUA custodian that is leaving the ACO and you are requesting to remove that DUA custodian.

  • If your ACO’s legal entity name or address has changed.

  • If your ACO needs to add personnel to the DUA.

To fill out and submit a DUA Addendum, please follow the instructions below:

  • Include the current DUA number, user role, name, phone number, organization, address, and email on the DUA Addendum
    form. (Please note that the addendum in the link provided was revised, as of October 2018.) Though there are additional user
    roles listed on the DUA Addendum form, the Shared Savings Program only utilizes the following user roles: DUA requestor,
    DUA custodian, and subcontractor. If adding a DUA custodian or DUA requestor, the DUA Addendum must be signed by the
    person who is requesting to be added to the DUA.

  • More details regarding the DUA Custodian and the DUA Requestor can be found in the tip sheet, Overview of ACO-MS User
    Access and ACO Contacts, located in the Resources section of the SSP ACO Portal. https://portal.cms.gov/wps/portal/unauthportal/home/

  • If adding a subcontractor, include the name of the organization on the “Organization” line and provide the other required
    contact information. Please note that only organizations can be subcontractors; individuals cannot be subcontractors. For a
    subcontractor, the form does not need to be signed and an individual does not need to be listed on the “Name” line.

  • Please leave the bottom section blank for CMS to complete.

  • The DUA Addendum must be submitted by an ACO contact who is currently listed in ACO-MS. https://acoms.cms.gov/

  • Email the completed DUA Addendum to SharedSavingsProgram@cms.hhs.gov with the following Subject line: “AXXXX DUA
    ##### Addendum.” Note: AXXXX is the identification number assigned to the ACO (the letter “A” followed by four numbers)
    and ##### is the DUA number assigned to the ACO. An ACO can find its DUA number by logging into ACO-MS, clicking on
    the My ACOs tab, and selecting its ACO. On the Agreement Details page, the DUA number will be listed under “Other
    Information.”

  • In order to process your request in a timely manner, please make sure you include the reason for your submission (e.g., add
    subcontractor, change requester, etc.) in your email content and attach the DUA Addendum to your email.

Once received, CMS will review the information submitted in the DUA Addendum. This includes verification that the form was
submitted by a proper party. If approved, the ACO contacts who were listed on the original email request will receive a
confirmation email that the DUA Addendum was executed. A PDF copy of the ACO’s updated DUA will be attached to the
confirmation email. The ACO contacts should review the updated DUA to confirm that the requested changes were made and
retain a copy of the DUA for their organization’s records. If you have questions or concerns about your DUA, email the Shared
Savings Program mailbox at SharedSavingsProgram@cms.hhs.gov.

CMS is committed to providing ACO-specific responses to questions from ACOs. Therefore, it is important to include your ACO ID (Axxxx) in all communication with CMS, specifically emails to SharedSavingsProgram@cms.hhs.gov.

The Data Use Agreement (DUA) is the agreement all ACOs must execute prior to the release of, or granting of access to, data files containing protected health information and individual identifiers. The DUA Addendum is the form ACOs use to add individuals or organizations to the DUA. The addendum is required if any ACO plans to share covered data (in a manner permissible by the terms of the DUA) outside of its organization.

Your ACO may work with any data vendors/business associate from outside the organization. If you decide to work with a third party and share data obtained from CMS through the Shared Savings Program, you must complete a DUA Addendum. Third party vendors are considered as subcontractors. Every individual within an outside organization accessing CMS data will have to complete a DUA Addendum.

CMS cannot provide ACOs with guidance regarding federal regulations; you should work with your legal team to review the DUA and the DUA Amendment as well as all relevant privacy laws concerning uses of CMS data. For additional information regarding Data Use requirements, please visit the Data Disclosures and Data Use Agreements (DUA) webpage: https://www.cms.gov/Research-Statistics-Data-and-Systems/Files-for-Order/Data-Disclosures-Data-Agreements/Overview.html

Please keep in mind the ACO is responsible for any and all data given to them by CMS and if the ACO chooses to give access to their data to another organization, the ACO is still responsible for how that data is used.


Regards, The Medicare Shared Savings Program Staff

Medicare Shared Savings Program Staff
CENTERS FOR MEDICARE & MEDICAID SERVICES
7500 Security Boulevard | Baltimore, MD 21244 | e-mail SharedSavingsProgram@cms.hhs.gov | web http://www.cms.gov/sharedsavingsprogram

Search