Resources
Data Use Agreements (DUA)
Data Use Agreements (DUAs) are contractual documents used for the transfer of non-public data that is subject to some restriction on its use. DUAs serve to outline the terms and conditions of the transfer. Specifically, DUAs address important issues such as limitations on the use of the data, obligations to safeguard the data, liability for harm arising from the use of the data, publication, and privacy rights that are associated with transfers of confidential or protected data. The understanding established by a DUA can help avoid later issues by clearly setting forth the expectations of the parties (provider and recipient). Having a signed DUA in place may be a required precondition to transfers of certain data, or it may simply be a good idea. Determining whether a DUA is required is necessarily context-dependent. When a DUA is required, it must be study-specific – i.e. data cannot be transferred pursuant to "master" or blanket sharing agreements. DUAs must be signed by a University of Mississippi Medical Center (UMMC) official who has the appropriate delegated signature authority.
The purpose of this guidance is to assist its users in assessing whether a proposed outgoing transfer of data that is in the possession of UMMC and/or a UMMC investigator (developed in his or her work for UMMC) to a third party (i) is permissible; and (ii) if so, whether a DUA is necessary or recommended to affect the transfer. This guidance contemplates the outgoing transfer of data to third parties who have a bona fide research use or practical application for the data (e.g. collaborating research institutions, academicians, public policymakers, community service providers, etc.). Note: this guidance does not address incoming data to be accepted by UMMC, or a UMMC investigator, from a third party, nor does it address providing data to a web hosting service, which comes with a different set of considerations. Rather, this guidance contemplates the outgoing transfer of data to third parties who have a bona fide research use or practical application for the data (e.g. collaborating research institutions, academicians, public policymakers, community service providers, etc.). Where the incoming transfer of data is proposed, the data provider will determine whether a DUA is necessary.
Common terms of a DUA provide that the recipient will:
not use, disclose, or destroy the data set other than as permitted by the DUA, or as required by law;
use appropriate administrative, technical, and physical safeguards to prevent unauthorized uses or disclosures of the data set, including specific data transfer/access/disposition instructions;
report to the provider any uses or disclosures of the data set that are in violation of a DUA;
ensure that anyone to whom it provides the data set agrees to the same requirements that apply to the recipient for receiving or accessing the data; and
not re-identify or contact the data subjects (for data related to a human subject).
Is a DUA needed?
Still unsure if a DUA is needed? See the DUA Decision Tree.
Who will handle my DUA?
The University of Mississippi Medical Center Office of Research and Sponsored Programs in collaboration with the Office of Integrity and Compliance. Contact sponsoredprograms@umc.edu.
Submitting a DUA Request
The DUA Scope of Work Form provides the relevant central office the necessary background information about the research. A project summary, list of data elements, funding sources, expectations for sharing results and publication authorship, and human/animal/stem cell compliance (as applicable) are essential to ensuring the terms of the DUA are appropriate. The ORSP Sponsored Programs Project Manager may contact you with additional questions based on the information provided and the specific agreement terms. ORSP will consult with other compliance and legal offices at UMMC, in our review of the DUA to ensure adequate protective measures and approvals are in place. Changes to the agreement may be necessary based on project/data specifications.
