When Do I Need A Data Use Agreement

The process of developing, verifying and negotiating data use agreements depends on the data, the data source, the expected use and compliance with the Rutgers guidelines. A restricted data set excludes certain direct identifiers (identifiers that constitute protected health information, or PHI directly identifying research subjects) from the person or parents, employers or members of the person`s household. The “limited dataset” provisions also require covered companies to take appropriate measures to remedy any breaches by a recipient of the data usage agreement. In other words, if Hopkins finds that the data provided to a recipient is being used in a way that is not authorized by the agreement, it must work with the recipient to resolve that issue. If these measures are not successful, Hopkins should terminate the transfer of PHI to the recipient as part of the data usage agreement and report the situation to the privacy office ji at 410-614-9900 or hipaa@jhmi.edu. Rutger`s PIs are often required to sign DUAs like Read and Understood. Rutgers urges his listeners to read the DUAs carefully before signing. Not all OAUs are equal, and it is very important that Rutger`s PIs and Key Staff understand and respect the terms of the agreement. A data usage agreement determines who can use and receive the LDS, as well as the use and disclosure of this information by the recipient and provides that the recipient does so: a counterparty agreement is a contract between the covered entity and the counterparty that gives these guarantees in writing. As part of a counterparty agreement, the parties must indicate the types of PPH and access to PPHs that a trading partner will have (and what types of access and access they might not have), as well as the safeguards that the counterparty will use to preserve the integrity and confidentiality of the PHI. A covered company (Hopkins) can use its own staff to create a “limited data set.” DHHS also indicated that a covered business can allow a person requesting a “limited data set” to create it as long as the person acts as the business partner of the entity concerned. A business partner is someone who is not part of the staff of the covered company, but uses the covered company`s PHI to perform a task on behalf of the covered company.