DUA - Forms

Effective June 1, 2012, all DUA request submissions must follow the e-mail Subject line instructions below.

CMS is currently updating all of our DUA forms.  As the new forms become available, they will be posted to our website using the previously established universal resource locations (URL).  As the new forms are published, you will notice references to digital signatures on the instructions page and a new look to the signature field(s) on each form.  The CMS privacy staff is currently only accepting digitally signed DUA forms from individuals with credentials issued by the federal government.  In the very near future, we hope to expand the use of digital signatures on CMS DUA forms to the general public.  When the policy changes, we will post a notice on this website and notify all contacts on a currently open DUA via e-mail.  During the interim, we ask for your patience as we travel down the road towards a truly paperless DUA process.

The forms listed below are associated with the CMS Privacy program and Data Use Agreement (DUA) procedures.  Some additional forms may be required for researcher data requests.

Researchers - all DUA requests from researchers for new data, requests to add data to an existing DUA or re-use data, must be processed and submitted to CMS via our Researcher Data Assistance Center, ResDAC, a CMS contractor that provides free assistance to anyone interested in using Medicare and/or Medicaid data. Contact ResDAC via:

• e-mail ResDAC@umn.edu
• toll-free 1-888-973-7322
• on-line www.ResDAC.org

All requests for DUA actions must be submitted to CMS via e-mail.  Any forms must be signed, scanned and attached to the e-mail and sent to DataUseAgreement@cms.hhs.gov.  

1. Unless specifically directed otherwise, send requests only to DataUseAgreement@cms.hhs.gov
2. Scanned documents are preferred to be file type .pdf
3. Submit one (1) DUA request per e-mail
4. Addendum forms for a new DUA may all be submitted together with the DUA request in one (1) e-mail
5. Submit contact information updates separately from DUA extension requests

E-mail Subject Lines:

Note 1: except to close a DUA, all CMS contracts and federal contracts/grants must be submitted through the federal contact for that specific DUA

Note 2: researchers must submit via ResDAC 

Note 3: for DUAs that are not yet created, replace DUA ##### with organization/researcher name

CMS Contractors must submit all DUA associated requests (except closures) through their CMS Contract Officer Representative (COR) or Government Task Lead (GTL)

CMS DUA Forms

DUA Form-0235 to request Personally Identifiable Information (PII) from a CMS Privacy Act System of Records (SOR), with the exception of:

1. Adding new data to a currently open DUA - use the Update Form-0235
2. Limited Data Sets (LDS) - use the LDS Form-0236
3. Disproportionate Share Hospital (DSH) data - use the DSH Form-0235d or the DSH Form-0235d2 as applicable
4. State and Territory requests for the Enrollment Database (EDB) State Customized file - use the EDB State Form-0235st

DUA LDS Form-0236l for files derived from CMS Privacy Act Systems of Records 

DUA DSH Form-0235d1 for Cost Reporting Periods Prior to December 8, 2004

DUA DSH Form-0235d2 for Cost Reporting Periods Including December 8, 2004 and Thereafter 

DUA EDB State Form-0235st to request the EDB customized State file (for States/Territories only) 

DUA Addendum Form-0235a to request an additional individual to be listed on the DUA.

DUA Update Form-0235u to request additional data descriptions to be added to a DUA.

DUA Certification of Disposition Form-10252 to request closure of a CMS DUA