42 CFR 425.710
§ 425.710 Data use agreement.
United States · 42 CFR — Public Health · Status: effective
Cite this
- Citation
- 42 CFR 425.710, § 425.710 Data use agreement, United States, version 1 as recorded 2026-07-09, yourstate.us, https://yourstate.us/provision/205365
- Permanent ID
ys:prov:205365@1- SHA-256
72e7222caa73088cfdbbcc1a653fc8ed51ac73287cfbd2d0d7e06fe26f89e207
The hash is SHA-256 of this version's text, with every run of whitespace collapsed to a single space and the ends trimmed. The ID always leads back here, and checking it says whether the text you cited is still the current version.
Full text
(a)(1) Before receiving any beneficiary identifiable data, ACOs must enter into a DUA with CMS. Under the DUA, the ACO must comply with the limitations on use and disclosure that are imposed by HIPAA, the applicable DUA, and the statutory and regulatory requirements of the Shared Savings Program.
(2) If the ACO misuses or discloses data in a manner that violates any applicable statutory or regulatory requirements or that is otherwise non-compliant with the provisions of the DUA, it will no longer be eligible to receive data under subpart H of this part, may be terminated from the Shared Savings Program under § 425.218, and may be subject to additional sanctions and penalties available under the law.
(b) [Reserved]
Legislative history
This is a federal regulation, adopted through agency rulemaking under the Administrative Procedure Act — not enacted by a recorded vote of Congress.