DUA Decision Tree Image Long Description

Overview

The decision tree helps to decide if a data use agreement (DUA) is needed for a proposal. If the data is from human subjects research, determine if the data is Health Insurance Portability and Accountability Act (HIPAA) protected. If it is, a DUA is required. If the data is not HIPAA protected, check to see if the data has any of these: PII, PHI, education records, CRI, card holder data, CP, confidential information per the NCPRA, information protected by law or policy, or personally identifiable or proprietary data. If the data does have any of those items, a DUA is required. If it does not, determine if the data is from a sponsored research project. If yes, a DUA is required. If not, determine if there are other contractual restrictions. If access rules apply, a DUA may be recommended. If not, determine if the data is from a third party. If yes, a DUA may be recommended. If not, determine if a DUA is a good idea by asking if the PI considers the data to be proprietary. If yes, a DUA may be recommended. If not, determine if the PI wants to restrict the use of the data. If yes, a DUA may be recommended. If not, a DUA is not required.

Presentation

1. Is the data from human subjects research?

   1. If yes, go to this question: Is the data HIPAA protected?

      1. If yes, DUA is required.

      2. If no, if the data contains any of these items, a DUA is required. Otherwise, go to this question: Is data from a sponsored research project?

         1. PII – Personally Identifiable Information

         2. PHI – protected health information

         3. Education Records

         4. CRI – Customer Record Information

         5. Card Holder Data

         6. CPI – Confidential Personnel Information

         7. Confidential per NCPRA (National Cooperative Research and Production Act of 1993)

         8. Info protected by law or policy

         9. Personally identifiable or proprietary data

   2. If no, go to this question: Is data from a sponsored research project?

2. Is data from a sponsored research project?

   1. If yes, DUA may be required.

   2. If no, go to this question: Other Contractual Restrictions?

3. Other Contractual Restrictions?

   1. Do access rules apply?

      1. If yes, DUA may be recommended.

      2. If no, ask this question: Data from 3rd Party?

         1. If yes, DUA may be recommended.

         2. If no, go to this question: Is a DUA a good idea?

4. Is a DUA a good idea? Proceed to next two questions.

   1. Does PI consider data "proprietary"?

      1. If yes, DUA may be recommended.

      2. If no, proceed to next question.

   2. Does PI wish to restrict use of data?

      1. If yes, DUA may be recommended.

      2. If no, DUA is not required.

Go back to the image in context.