• E-mail
• Print
• RSS

Question: What does a data user agreement look like?

HIPAA Weekly Advisor, February 16, 2004

Want to receive articles like this one in your inbox? Subscribe to HIPAA Weekly Advisor!

Question: What does a data user agreement look like?

Answer: You can use or disclose a limited set of PHI only if the party who requests this information can assure you, in the form of a data use agreement, that the PHI data set will only be used or disclosed for limited purposes. A data use agreement between you and the party receiving the data must

--establish the permitted uses and disclosures of information by the data recipient. The agreement may not authorize the user to use or further disclose the information in a way that would violate HIPAA requirements, if you made such uses or disclosures

--establish who is permitted to use or receive the limited data set

--provide that the data recipient will a) not use or further disclose the information other than as permitted by the agreement or as otherwise required by law; b) prevent PHI uses or disclosures not mentioned in the data use agreement; c) report to the covered entity any such improper use or disclosure d) ensure that any agents who receive the data agree to these same restrictions; e) not identify the information or contact the individuals.

For more information see 45 CFR Section 164.514(e) Limited Data Set http://www.bricker.com/legalservices/practice/hcare/hipaa/164.514e.asp

Want to receive articles like this one in your inbox? Subscribe to HIPAA Weekly Advisor!

• E-mail to a Colleague
• Print
• RSS
• Archive