Skip Navigation

State Databases Data Use Agreement
DATA USE AGREEMENT for the State Databases from the Healthcare Cost and Utilization Project Agency for Healthcare Research and Quality

This Data Use Agreement ("Agreement") governs the disclosure and use of data in the HCUP State Databases from the Healthcare Cost and Utilization Project (HCUP) which are maintained by the Center for Delivery, Organization, and Markets (CDOM) within the Agency for Healthcare Research and Quality (AHRQ). The HCUP State databases include the State Inpatient Databases (SID), State Ambulatory Surgery and Services Databases (SASD), and State Emergency Department Databases (SEDD). Any person ("the data recipient") seeking permission from AHRQ to access HCUP State Databases must sign and submit this Agreement to AHRQ or its agent, and complete the online Data Use Agreement Training Course at www.hcup-us.ahrq.gov, as a precondition to the granting of such permission.

Section 944(c) of the Public Health Service Act (42 U.S.C. 299c-3(c)) ("the AHRQ Confidentiality Statute"), requires that data collected by AHRQ that identify individuals or establishments be used only for the purpose for which they were supplied. Pursuant to this Agreement, data released to AHRQ for the HCUP Databases are subject to the data standards and protections established by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) (P.L. 104-191) and implementing regulations ("the Privacy Rule"). Accordingly, HCUP Databases may only be released in "limited data set" form, as that term is defined by the Privacy Rule, 45 C.F.R. § 164.514(e). HCUP data may only be used by the data recipient for research which may include analysis and aggregate statistical reporting. AHRQ classifies HCUP data as protected health information under the HIPAA Privacy Rule, 45 C.F.R. § 160.103. By executing this Agreement, the data recipient understands and affirms that HCUP data may only be used for the prescribed purposes, and consistent with the following standards:

No Identification of Persons-The AHRQ Confidentiality Statute prohibits the use of HCUP data to identify any person (including but not limited to patients, physicians, and other health care providers). The use of HCUP Databases to identify any person constitutes a violation of this Agreement and may constitute a violation of the AHRQ Confidentiality Statute and the HIPAA Privacy Rule. This Agreement prohibits data recipients from releasing, disclosing, publishing, or presenting any individually identifying information obtained under its terms. AHRQ omits from the data set all direct identifiers that are required to be excluded from limited data sets as consistent with the HIPAA Privacy Rule. AHRQ and the data recipient(s) acknowledge that it may be possible for a data recipient, through deliberate technical analysis of the data sets and with outside information, to attempt to ascertain the identity of particular persons. Risk of individual identification of persons is increased when observations (i.e., individual discharge records) in any given cell of tabulated data is <10. This Agreement expressly prohibits any attempt to identify individuals, including by the use of vulnerability analysis or penetration testing. In addition, methods that could be used to identify individuals directly or indirectly shall not be disclosed, released, or published. Data recipients shall not attempt to contact individuals for any purpose whatsoever, including verifying information supplied in the data set. Any questions about the data must be referred exclusively to AHRQ. By executing this Agreement, the data recipient understands and agrees that actual and considerable harm will ensue if he or she attempts to identify individuals. The data recipient also understands and agrees that actual and considerable harm will ensue if he or she intentionally or negligently discloses, releases, or publishes information that identifies individuals or can be used to identify individuals.

Use of Establishment Identifiers-The AHRQ Confidentiality Statute prohibits the use of HCUP data to identify establishments unless the individual establishment has consented. Permission is obtained from the HCUP data sources (i.e., state data organizations, hospital associations, and data consortia) to use the identification of hospital establishments (when such identification appears in the data sets) for research, analysis, and aggregate statistical reporting. This may include linking institutional information from outside data sets for these purposes. Such purpose does not include the use of information in the data sets concerning individual establishments for commercial or competitive purposes involving those individual establishments, or to determine the rights, benefits, or privileges of establishments. Data recipients are prohibited from identifying establishments directly or by inference in disseminated material. In addition, users of the data are prohibited from contacting establishments for the purpose of verifying information supplied in the data set. Any questions about the data must be referred exclusively to AHRQ. Misuse of identifiable HCUP data about hospitals or any other establishment constitutes a violation of this Agreement and may constitute a violation of the AHRQ Confidentiality Statute.

The undersigned data recipients provide the following affirmations concerning HCUP data:

Protection of Individuals

  • I will not release or disclose, and will take all necessary and reasonable precautions to prohibit others from releasing or disclosing, any information that directly or indirectly identifies persons. This includes attempts to identify individuals through the use of vulnerability analysis or penetration testing.


  • I will not release or disclose information where the number of observations (i.e., individual discharge records) in any given cell of tabulated data is <10
  • . The publication of a cell containing a value of 1 to 10 is prohibited.

  • I will not attempt to link, and will prohibit others from attempting to link, the discharge records of persons in the data set with individually identifiable records from any other source.


  • I will not attempt to use and will take all necessary and reasonable precautions to prohibit others from using the data set to contact any persons in the data for any purpose.

Protection of Establishments

  • I will not publish or report, through any medium, data that could identify individual establishments directly or by inference.


  • When the identities of establishments are not provided in the data sets, I will not attempt to use and will take all necessary and reasonable precautions to prohibit others from using the data set to learn the identity of any establishment.


  • I will not use and will take all necessary and reasonable precautions to prohibit others from using the data set concerning individual establishments: (1) for commercial or competitive purposes involving those individual establishments; or (2) to determine the rights, benefits, or privileges of individual establishments.


  • I will not contact and will take all necessary and reasonable precautions to prohibit others from contacting establishments identified in the data set to question, verify, or discuss data in the HCUP databases.

Limitations on the Disclosure of Data and Safeguards

  • I acknowledge and affirm that I am personally responsible for compliance with the terms of this Agreement, to the exclusion of any other party, regardless of such party's role in sponsoring or funding the research that is the subject of this Agreement.


  • I will not share or disclose HCUP State data, without approval from AHRQ, for any purpose other than the project described and approved at the time of data purchase. Any subsequent data use requires the submission of a request (more information at www.hcup-us.ahrq.gov/tech_assist/centdist.jsp) and approval from AHRQ before the data may be used for a new purpose.


  • I will only allow access to HCUP State data for those working on projects approved by AHRQ, and I will require that they become authorized users of the HCUP data by signing a copy of this Data Use Agreement and completing the online Data Use Agreement Training Course at www.hcup-us.ahrq.gov/. Before granting any individual access to the data set, I will submit the signed data use agreements to the address at the end of this Agreement.


  • I will not use or disclose and I will prohibit others from using or disclosing the data set, or any part thereof, except for research, analysis, and aggregate statistical reporting, and only as permitted by this Agreement.


  • I will not redistribute HCUP data by posting on any Website or other publicly-accessible online repository.


  • I will ensure that the data are kept in a secured environment and that only authorized users will have access to the data.


  • I acknowledge and affirm that interpretations, conclusions, and/or opinions that I reach as a result of my analyses of the data sets are my interpretations, conclusions, and/or opinions, and do not constitute the findings, policies, or recommendations of the U.S. Government, the U.S. Department of Health and Human Services, or AHRQ.


  • I will acknowledge in all reports based on these data that the source of the data is the specific state(s) or data organization(s) that submitted data to HCUP, e.g., "state name(s), State Inpatient Databases (SID), Healthcare Cost and Utilization Project (HCUP), Agency for Healthcare Research and Quality." Substitute "State Ambulatory Surgery and Services Databases (SASD)" or "State Emergency Department Databases (SEDD)," as appropriate.


  • I will indemnify, defend, and hold harmless AHRQ and the data organizations that provide data to AHRQ for HCUP from any or all claims and losses accruing to any person, organizations, or other legal entity as a result of violation of this Agreement. This provision applies only to the extent permitted by Federal and State law.


  • I agree to report the violation or apparent violation of any term of this Agreement to AHRQ without unreasonable delay and in no case later than 30 calendar days of becoming aware of the violation or apparent violation.

Terms, Breach, and Compliance

Any violation of the terms of this Agreement shall be grounds for immediate termination of this Agreement. AHRQ shall determine whether a data recipient has violated any term of the Agreement. AHRQ shall determine what actions, if any, are necessary to remedy a violation of this Agreement, and the data recipient(s) shall comply with pertinent instructions from AHRQ. Actions taken by AHRQ may include but not be limited to providing notice of the termination or violation to affected parties and prohibiting data recipient(s) from accessing HCUP data in the future.

In the event AHRQ terminates this Agreement due to a violation, or finds the data recipient(s) to be in violation of this Agreement, AHRQ may direct that the undersigned data recipient(s) immediately return all copies of the HCUP State Databases to AHRQ or its designee without refund of purchase fees.

Acknowledgment

I understand that this Agreement is requested by the United States Agency for Healthcare Research and Quality to ensure compliance with the AHRQ Confidentiality Statute. My signature indicates that I understand the terms of this Agreement and that I agree to comply with its terms. I understand that a violation of the AHRQ Confidentiality Statute may be subject to a civil penalty of up to $14,140 under 42 U.S.C. 299c-3(d), and that deliberately making a false statement about this or any matter within the jurisdiction of any department or agency of the Federal Government violates 18 U.S.C. § 1001 and is punishable by a fine, up to five years in prison, or both. Violators of this Agreement may also be subject to penalties under state confidentiality statutes that apply to these data for particular states.

 
Signed:__________________________________________________________________ Date:_________________________
Print or Type Name:_____________________________________________________________
Title:______________________________________________________________________________________
Organization:________________________________________________________________________________
Address:____________________________________________________________________________________

Address:____________________________________________________________________________________
City:_______________________________________ State:__________ ZIP Code:__________________
Phone:____________________________________ Fax: __________________________________
E-mail:____________________________________________________________________________________
 

The information above is maintained by AHRQ only for the purpose of enforcement of this Agreement and for notification in the event data errors occur.

Note to Purchaser: Shipment of the requested data product will only be made to the person who signs this Agreement, unless special arrangements that safeguard the data are made with AHRQ or its agent.

Submission Information

Please send signed HCUP Data Use Agreements and proof of online training to:


HCUP Central Distributor
Social & Scientific Systems, Inc.
8757 Georgia Avenue, 12th Floor
Silver Spring, MD 20910
E-mail: HCUPDistributor@AHRQ.gov
FAX: (866) 792-5313

According to the Paperwork Reduction Act of 1995, no persons are required to respond to a collection of information unless it displays a valid OMB control number. The valid OMB control number for this information collection is 0935-0206. The time required to complete this information collection is estimated to average 30 minutes per response, including the time to review instructions, search existing data resources, gather the data needed, and complete and review the information collection. If you have any comments concerning the accuracy of the time estimate(s) or suggestions for improving this form, please write to: Agency for Healthcare Research and Quality, Attn: Reports Clearance Officer, 5600 Fishers Lane, Rockville, Maryland 20857.

OMB Control No. 0935-0206 expires 01/31/2019.

 

12-20-17

 

Internet Citation: State Databases Data Use Agreement. Healthcare Cost and Utilization Project (HCUP). December 2017. Agency for Healthcare Research and Quality, Rockville, MD. www.hcup-us.ahrq.gov/team/StateDUA.jsp.
Are you having problems viewing or printing pages on this Website?
If you have comments, suggestions, and/or questions, please contact hcup@ahrq.gov.
Privacy Notice, Viewers & Players
Last modified 12/20/17