Sutter Bay Hospitals d/b/a California Pacific Medical Center
Data Use Agreement
This Data Use Agreement (“Agreement”) is made and entered into by and between Sutter Bay Hospitals, a California non-profit public benefit corporation d/b/a California Pacific Medical Center on behalf of its Research Institute (“CPMC”), and the data recipient registering for access to the Limited Data Set as further identified below (“Data Recipient”) and is effective as of the Effective Date.
Recitals
A. The parties desire to comply with federal and California laws regarding the use and disclosure of individually identifiable health information (“PHI”), and in particular with the provisions of the federal Health Insurance Portability and Accountability Act of 1996, and the regulations promulgated thereunder, as amended from time to time (“HIPAA”).
B. The parties have accordingly determined that it is their wish and intent to enter into the following terms and conditions.
Agreement
Now therefore, in consideration of the promises set forth herein, the parties agree as follows:
1. This Agreement sets forth the terms and conditions pursuant to which CPMC shall disclose certain PHI from the “Osteoporosis in Men Study (“MrOS”) and any of its ancillary studies to the Data Recipient. Any capitalized terms in this Agreement shall have the same meanings as those same terms in Title 45 of the Code of Federal Regulations, part 164.
2. The PHI that CPMC shall disclose to the Data Recipient shall be a Limited Data Set. Except as otherwise specified herein, Data Recipient may make all Uses and Disclosures of the Limited Data Set necessary in order to conduct the research and/or educational purposes, as described in the research plan attached hereto this Agreement as Exhibit A, which is incorporated by reference herein(“Permitted Uses and Disclosures”). Such Permitted Uses and Disclosures shall be conducted in accordance with the MrOS Analysis Plans, MrOS Publication Guidelines and this Agreement.
3. Data Recipient agrees not to Use or Disclose the Limited Data Set for any purpose other than the Permitted Uses and Disclosures or as Required by Law.
4. Data Recipient agrees to use appropriate safeguards to prevent the Use or Disclosure of the Limited Data Set other than as provided for by this Agreement.
5. Data Recipient agrees to report to CPMC any Use or Disclosure of the Limited Data Set not provided for by this Agreement, of which it becomes aware, including without limitation any disclosure of PHI to an unauthorized subcontractor, within five (5) business days of its discovery.
6. Data Recipient may provide the Limited Data Set to those working under his/her direct supervision who have a need to know of the Limited Data Set for the purpose of the Permitted Uses and Disclosure (including subcontractors, students, fellows, and analysts) (collectively “Agents”); provided that, the Data Recipient ensures such Agents are obligated to the same conditions and restrictions on the Use and Disclosure of the Limited Data Set substantially similar to those of this Agreement. Any potential recipient, other than Agents, must submit a request to obtain the Limited Data Set directly from CPMC through the MrOS Online website and complete a separate Data Use Agreement for any such additional use or disclosure of the Limited Data Set.
7. Data Recipient agrees not to identify the information contained in the Limited Data Set or to contact the individual who is the subject of the information in the Limited Data Set.
8. Data Recipient agrees to obtain approval from the Data Recipient’s local IRB, if required, before the initiation of any analyses.
9. Data Recipient agrees to cite and acknowledge MrOS and its funding sources in all abstracts, presentations and publications, using language detailed in the MrOS Publication Guidelines (posted on the MrOS Online website), and make a good faith effort to follow the other provisions of these guidelines.
10. This Agreement and all obligations hereunder shall be effective on the Effective Date above, and shall remain in effect as long as Data Recipient retains the Limited Data Set, unless otherwise terminated as follows:
This Agreement may be terminated immediately by applicable law or regulation.
This Agreement may be terminated immediately upon the mutual written concurrence of both parties.
This Agreement may be terminated by Data Recipient returning or destroying the PHI, with verification to CPMC that all PHI has been returned and/or destroyed.
This Agreement may be terminated by CPMC should Data Recipient breach this Agreement and the breach is not cured within thirty (30) days after CPMC has notified Data Recipient of the breach. If this Agreement is so terminated, CPMC shall discontinue Disclosure of PHI; however, if such termination is not feasible, CPMC shall report the breach to the Secretary of the Department of Health and Human Services.
CPMC may terminate this Agreement at any time by revoking the Data Recipient’s access to the MrOS Online website as well as access to the Limited Data Set at CPMC’s sole discretion.
Data Recipient’s access to the MrOS Online website may be terminated at CPMC’s sole discretion, after one (1) year of Data Recipient’s receipt of the Limited Data Set.
11. Upon termination of this Agreement, if Data Recipient has not already returned or destroyed the PHI, Data Recipient shall return or destroy the PHI that it maintains in any form, and shall not retain any copies of the PHI, if feasible. Data Recipient shall certify to CPMC that Data Recipient has returned and/or destroyed all such PHI. If the parties agree that the return or destruction of PHI is not feasible, Data Recipient shall continue to extend the protections of this Agreement to the PHI, and limit further Use of the PHI to those purposes that make the return or destruction of the PHI infeasible.
12. Data Recipient agrees to have procedures in place for mitigating, to the maximum extent practicable, any deleterious effect from the Use or Disclosure of PHI in violation of this Agreement. Data Recipient shall be responsible for any and all costs (including the costs of CPMC) associated with mitigating or remedying any violation of this Agreement.
13. Data Recipient acknowledges that the Limited Data Set is provided as it and without any warranties, expressed or implied, including any warranty of fitness for a particular purpose. Data Recipient assumes all liability for damages which may arise from its use, analysis, or conclusions of the Limited Data Set. CPMC will not be liable to Data Recipient for any loss, claim or demand made by Data Recipient, or made against Data Recipient by any other party, due to or arising from the use or analysis of the Limited Data Set by Data Recipient, except to the extent permitted by law when caused by the gross negligence or willful misconduct of CPMC.
14. This Agreement shall be governed by and construed in accordance with the laws of the State of California, and venue for any actions relating to this Agreement shall be in San Francisco County.
On this _________ day of ________ (“Effective Date”), by clicking the “User Agreement” button on the website, mrosonline.ucsf.edu, the Data Recipient is certifying that he/she as well as any Agents to whom the Data Recipient provides the Limited Data Set, agrees to use or disclose the information contained in the Limited Data Set only as permitted in this Agreement.