Attachment 5 - Data Use Agreement Template.pdf

DATA USE AGREEMENT

This Data Use Agreement (“Agreement”) is between the Colorado Department of Public Health and Environment << Program/Division/Data Owner Name >> and _____________________ located at

<<Description of Data Owner and data>>

<<Description of Data User and reason for requested data>>

<< Program Name >> Obligations:

<<Under what authority the Program is able to share identifiable data.>>

<< Program Name >>, as the “Data Owner”, agrees to provide the following information to the Data User <<State either “in the format indicated in the Statement of Work (Attachment A)” or alternatively “as described”>>:

<< List files, by source, with data elements, and the format in which the data is to be delivered. Specify whether paper files, computerized records, etc., are provided if those provisions differ from those requested in the application. >>

The Data Owner shall ensure that identifying information is transmitted through secured telecommunications, including the secured Internet connections.

Data User Obligations:

A. Uses and Disclosures as Requested in this Agreement. The Data User shall use and disclose the confidential information provided by <<Program Name>> only for the activity described in the Attachment A. The Data User shall limit access to confidential information strictly to those individuals or classes of individuals who shall have access in order to perform the duties set forth in the application.

B. Nondisclosure except as Provided in this Agreement. The Data User shall not use or further disclose the confidential data except as specified in this Agreement.

C. Follow-Back. The Data User shall not contact the subject of the information, the subject’s next-of-kin, the subject’s physician or other provider or any other relative or interested party, <<except as follows: >>

D. Safeguards. The Data User agrees to take appropriate administrative, technical and physical safeguards to protect the data from any unauthorized use or disclosure not provided for in this

Attachment 5

Agreement.

E. Confidentiality Agreements. The Data User shall ensure that all persons who have access to the confidential information sign the Confidentiality Agreement (Attachment B). This includes, but is not limited to, all interns, sub-contractors, staff, other workforce members and consultants. A copy of the signed Confidentiality Agreement shall be maintained on file and be available for review by <<Program Name>>, if requested.

F. Reporting. Within 48 hours of the Data User’s discovery, the Data User shall report to <<Program Name>> any use or disclosure of the confidential information that violates either this Agreement or applicable state or federal laws or regulations.

G. Public Release. No confidential information shall be publicly released. Furthermore, any reports or aggregate tabulations that are prepared shall:

<<Insert Program or Division requirements for publications, if any, or remove this sentence. >>

H. Destruction of Records at End of Activity. Records shall be destroyed or returned to <<Program Name>> upon completion of the work described in the Statement of Work. The Data User agrees to send <<Program Name>> written notification that the data have been destroyed or returned the data <<by return date>> within 30 days of the completion of work described in the Statement of Work, if <<Program Name>> provides no specific date for destruction or return.

I. Minimum Necessary. The Data User attests that the confidential information requested represents the minimum information necessary for the Data User to perform duties described in the Statement of Work and that only the minimum necessary individuals shall have access to the confidential information in order to perform such work.

J. Institutional Review Board. If the activity involves research, the Data User agrees to furnish all documentation concerning Institutional Review Board (IRB) reviews and approvals. The Data User agrees to submit required documentation of any changes to the research protocol to an IRB prior to implementation of protocol changes. The Data User also agrees to submit to <<Program Name>> any change in protocol, or any changes in either the waiver status or conditions for IRB approval of the project related to work described in the Statement of Work.

K. Authorizations. The Data User agrees to obtain individual authorizations to the confidential information if the activity entails research, unless an IRB or Privacy Board approves a waiver of such an authorization. Documentation shall be provided prior to receipt of the confidential information.

L. Data Ownership. The Data Owner is <<Program Name>>. The Data User does not obtain any right, title or interest in any of the data furnished by the <<Program Name>>.

M. Publication/Release Requirements. Any release of information shall include the following statement:

<<Insert Program or Division requirements for publications.>>

In addition, the Data User shall notify <<Program Name>> when the publication or presentation is available and, further, shall provide a copy of it to the Data Owner upon request.

<<CDPHE Program Signatory Name and Position>>

Signature:

Date:

Joni Koenig, MSPH, CIP Privacy Officer Colorado Department of Public Health and Environment

Signature:

Date:

<<Data User Signatory Name and Position>>

Signature:

Date:

ATTACHMENT B – CONFIDENTIALITY AGREEMENT

[Each individual with access to Colorado Department of Public Health and Environment (CDPHE) confidential data will be provided a copy of the Data Use Agreement and will sign a Confidentiality Agreement prior to accessing the data.]

Data User Name: _____________________________________________________________________

Data User Organization: _______________________________________________________________

Address: ____________________________________________________________________________

Project/Protocol Name:

Purpose:

Specific records/information requested:

Procedures for protecting confidentiality of data/information (Please acknowledge agreement by checking each box.):

☐ The Data User shall use and disclose the data provided by CDPHE only for the activities described in the Data Use Agreement.

☐ The Data User shall limit access to data strictly to those individuals or classes of individuals who shall have access in order to perform the activities described in the Data Use Agreement.

☐ The Data User shall not use or further disclose the data to third-parties, including the federal government, except as specified in the Data Use Agreement.

☐ The Data User shall not contact the subject of the data, the subject’s next-of-kin, the subject’s physician or other provider, or any other relative or interested party using the data provided by CDPHE.

☐ The Data User shall not attempt to deduce the identity of the subject of the data (e.g., attempt to link the data provided with records that include names from any other dataset).

☐ The Data User agrees to take appropriate administrative, technical, and physical safeguards to protect the data from any unauthorized use or disclosure not provided for in the Data Use Agreement.

☐ Within 48 hours of the Data User’s discovery, the Data User shall report to CDPHE any use or disclosure of the data that violates either the Data Use Agreement or applicable state or federal laws or regulations.

☐ The Data User shall not publically release the data.

☐ The Data User attests that only the minimum necessary individuals shall have access to the data in order to perform the activities described in the Data Use Agreement.

☐ The Data User certifies under the penalty of perjury that they have not and will not use or disclose any Personal Identifying Information, as defined by § 24-74-102(1), C.R.S., for the purpose of investigating for, participating in, cooperating with, or assisting Federal Immigration Enforcement, including the enforcement of civil immigration laws, and the Illegal Immigration and Immigrant Responsibility Act, which is codified at 8 U.S.C. §§ 1325 and 1326, unless required to do so to comply with Federal or State law, or to comply with a court-issued subpoena, warrant, or order.

By signing below, I agree with the conditions for use of/access to confidential Colorado Department of Public Health and Environment data/information.

Name:

Role:

Signature:

Date: