Skip Navigation

DUA Training - Accessible Version
Healthcare Cost and Utilization Project Data Use Agreement Course


Whatever ... I see or hear... which ought not to be spoken of abroad, I will not divulge, as reckoning that all such should be kept secret. Hippocratic Oath, circa 4th Century B.C.

When all is said and done, will our health care records be used to heal us or reveal us? ~Donna Shalala, Former U.S. Secretary of Health and Human Services

Protecting the privacy of the individuals and institutions that are featured in your health care research is imperative. The HCUP Data Use Agreement safeguards the confidentiality of patients, physicians, and health care institutions.

Contents:
  1. Introduction
  2. HCUP and AHRQ
  3. Why Adherence Is Important
  4. Protection of Individual Identities
  5. Restrictions on Hospital ID
  6. Appropriate Use of Data
  7. Data Use Restrictions
  8. HIPAA
  9. Publishing Recommendations
  10. Review
  11. Conclusion

1. Introduction


Welcome to the Healthcare Cost and Utilization Project (HCUP) Data Use Agreement (DUA) Training!

HCUP databases offer a national information resource of discharge-level health care data. Because of the sensitive nature of health data, this information must be safeguarded to protect the privacy of individuals and institutions. The purpose of this course is to:

  • Emphasize the importance of data protection
  • Reduce the risk of inadvertent violations
  • Describe your individual responsibility when using HCUP data
This course will take approximately 15 minutes to complete.

The goal of this course is to explain important requirements in the HCUP Data Use Agreement.

HCUP Data Use

When working with health care information, researchers have a responsibility to maintain the privacy rights of the individuals and institutions featured in their data. The proper use of HCUP databases, including strict adherence to the Data Use Agreement, will help protect the availability of this valuable data resource.

  • HCUP data contain confidential information concerning the clinical condition of patients and the medical services they receive. The HCUP Data Use Agreement contains specific requirements to protect the privacy rights of the individuals and institutions within the HCUP data sets.
  • HCUP databases provide a wealth of information to enhance your health care research and promote the advancement of the field. You are responsible for safeguarding the HCUP data that you obtain. Guarding the confidentiality of the data and the privacy of individuals is vital to the continued availability of health data to researchers in the future.
Return to Contents


2. HCUP and AHRQ


The Agency for Healthcare Research and Quality (AHRQ) is a Federal agency within the Department of Health and Human Services. AHRQ's mission is: "To produce evidence to make health care safer, higher quality, more accessible, equitable, and affordable, and to work with HHS and other partners to make sure that the evidence is understood and used."

To accomplish this goal, AHRQ supports a broad base of health care research. AHRQ also sponsors the Healthcare Cost and Utilization Project (HCUP).

  • Health care researchers publish their findings to promote improvements in many aspects of health care, including quality, cost, delivery, and disparities in health care services.
  • HCUP databases bring together the data collection efforts of state-level Data Organizations (HCUP Partners) and the Federal government.
  • HCUP uses the state-level data to create a uniformly formatted national information resource of discharge-level health care data.
  • Health care researchers gain online access to information about HCUP databases at www.hcup-us.ahrq.gov/.
Return to Contents


3. Why Adherence Is Important


HCUP data are a valuable resource for the health care research community. It is vital to maintain a balance between protecting data privacy and securing the use of data in national health care research. Strict adherence to the HCUP Data Use Agreement (DUA) ensures the long-term viability of HCUP. Violations of the DUA could force AHRQ to discontinue providing public release versions of the data.

You must sign a Data Use Agreement (DUA) and complete the online Data Use Agreement Training Course at www.hcup-us.ahrq.gov before you are given access to HCUP data. The DUA is a legally binding agreement with AHRQ that defines how you can use HCUP data. The DUA covers the following topics:

Individual responsibility

Your signature on the DUA acknowledges that:

  1. You have read and understand the requirements for using HCUP data.
  2. You agree to be bound by AHRQ rules and regulations in the DUA.
  3. You understand that there are civil and criminal penalties for violating any provision of the DUA.
You will be held personally responsible for adherence to each clause in the agreement. Remember, you are responsible, not your organization.

Governing regulations

Each participating Data Organization that contributes data for HCUP databases has its own policies and governing regulations on data use and handling. The provisions outlined in the DUA reflect the requirements contained in legal Memorandums of Agreement (MOA) between each contributing data Partner and AHRQ.

Consequences

When you sign the DUA, you agree to comply with the requirements listed. If you violate the DUA, the following consequences may occur:
  • Legal consequences: You may be fined and/or sentenced to a prison term.
  • Restricted use of data: If a violation were to occur, it could have long-term effects on the credibility of other health care researchers. This misuse could result in a loss of cooperation from other agencies and lead to restricted access to data.
Return to Contents


4. Protection of Individual Identities


HCUP data contain discharge-level information on inpatient, ambulatory surgery, or emergency department care in U.S. hospitals. For confidentiality purposes, all data elements that directly identify an individual have been removed.

However, through deliberate and sophisticated technical analysis, it might be possible to ascertain the identity of particular persons. This would be considered a violation of the HCUP DUA.

The HCUP DUA prohibits users from making any effort to determine the identity of any person contained in the data, including patients, physicians, and other health care providers.

Risk of individual identification is increased under certain circumstances. Under the HCUP DUA, you are prohibited from releasing, disclosing, publishing, or presenting any individually identifying information obtained from the data. It is also your responsibility to prohibit anyone else who has access to HCUP data from identifying individuals within the data.
  • Do not report cell sizes where n is less than or equal to 10 in any published table.

    In a small sample, an identity could be determined indirectly (e.g., a rare genetic condition in a rural county). Such a disclosure would be a direct violation of the privacy rights of that individual.

    Do not report tabulated data in a cell size less than or equal to 10. Report only counts of 11 or more.

  • Protection of Individual Identities DUA Excerpt 1

    "I will not release or disclose information where the number of observations (i.e., individual discharge records) in any given cell of tabulated data is less than or equal to 10 (i.e., report only counts of 11 or more)."

  • Do not attempt to learn the identity of individuals through any deliberate technical analysis, including through vulnerability analysis or penetration testing of the data.

    HCUP data exclude information that could directly identify individuals, such as names, Social Security Numbers, and addresses of patients and physicians.

    The DUA prohibits users from making any effort to discover the identity of any person in the data.

    This restriction includes patients, physicians, and other health care providers.

  • Protection of Individual Identities DUA Excerpt 2

    "I will not release or disclose, and will take all necessary and reasonable precautions to prohibit others from releasing or disclosing, any information that directly or indirectly identifies persons. This includes attempts to identify individuals through the use of vulnerability analysis or penetration testing"

  • Do not publish methodology that could be used to identify individuals.

    In addition to prohibiting data users from attempting to identify individuals in their own work, it is also your responsibility under the HCUP DUA to prohibit others from attempting to use the data to learn the identity of any individual.

    It is also a violation of the DUA to publish any methodology that could be used by others to identify individuals through the use of HCUP data.


  • Protection of Individual Identities DUA Excerpt 3

    "Methods that could be used to identify individuals directly or indirectly shall not be disclosed, released, or published"

Scenario 1:

Sara: "Hi Donna. How is your research report coming along?"

Donna: "Great. I am using HCUP State data to study a rare medical condition, Kawasaki's disease in children. In certain counties or geographical areas, the incidence of the condition reveals only one or two cases of the disease in a given year. I would like to publish these findings and include a table recording the incidence of the disease for these areas. However, within the table there will be 'cell sizes' under 10. Can I get an exception for this restriction and publish it with these smaller cells?"

Narrator:"Can Donna publish her findings of the incidence of Kawasaki's disease?"

Choose the best answer.

  1. Yes, since this is a rare disorder, Donna can publish her findings.
  2. Yes, if she receives approval from Sara, her supervisor.
  3. No, this would be in violation of the HCUP State DUA.
Select this link for the answer to Scenario 1: Scenario 1 Answer

Return to Contents


5. Restrictions on Hospital Identification


Depending on the policies and laws of the state providing the information, HCUP data may include the identities of hospitals and other health institutions. The identities of these institutions are made available for research purposes, but must not be disclosed through publication or any other means.

Restrictions on Hospital Identification DUA Excerpt

"I will not publish or report, through any medium, data that could identify individual establishments directly or by inference."

Return to Contents


6. Appropriate Use of Data


As someone who works with confidential information, it is important for you to know what you can and cannot do with it. You are responsible for how you and others in your research group use the HCUP data to which you have access.

  • You may use HCUP data for research, analysis, and aggregate statistical reporting.
    • Appropriate Use of Data DUA Excerpt 1

      "I will not use or disclose and I will prohibit others from using or disclosing the data set, or any part thereof, except for research, analysis, and aggregate statistical reporting, and only as permitted by this Agreement."


  • You may share HCUP data with your immediate research group. HCUP databases are created by and for researchers. Sharing information is critical to research projects, but you must not share HCUP data outside of your immediate research group. Please note that each member of the group must take this training. In addition, each must sign the HCUP Data Use Agreement and send it to the address at the bottom of the form.

    • Appropriate Use of Data DUA Excerpt 2

      I will only allow access to HCUP State (or Nationwide) data for those working on projects approved by AHRQ, and I will require that they become authorized users of the HCUP data by signing a copy of this Data Use Agreement and completing the online Data Use Agreement Training Course at www.hcup-us.ahrq.gov. Before granting any individual access to the data set, I will submit the signed data use agreements to the address at the end of the Data Use Agreement.


  • You may merge other data with HCUP data to conduct research when state organizations have provided data elements that allow this (for example, hospital identifiers, counties, ZIP Codes). Linking to outside data sources is permissible when the linkage is used to enhance the data and not to identify individuals. You may also share summarized data for inclusion in publications. Raw micro data may not be shared outside your immediate research group.

    • Appropriate Use of Data DUA Excerpt 3

      "I will not attempt to link, and will prohibit others from attempting to link, the discharge records of persons in the data set with individually identifiable records from any other source."
Scenario 2:

Narrator: "Tom has just purchased HCUP data and is eager to begin his research project. He plans to collaborate with a few colleagues at his University and also plans to have John, a programmer at another institution, run some of the analyses."

John: "I want to get started on this analysis. Can you just send the data file to me?"

Tom: "As the data purchaser, I am responsible for the security of the data files, so I want to be careful about following all the requirements of the HCUP Data Use Agreement"

Narrator: "What steps does Tom need to take before he can share the HCUP data with John and his other colleagues?
(Choose all that apply)."
  1. Each of his colleagues must complete the online Data Use Agreement training course
  2. Each of his colleagues must read and sign the HCUP Data Use Agreement.
  3. Tom must send the online training completion certificates and signed DUAs for each of his colleagues to the Central Distributor.
  4. Tom must ensure that the data are kept in a secured environment and that only authorized users will have access to the data.
Select this link for the answer to Scenario 2: Scenario 2 Answer

Return to Contents


7. Data Use Restrictions


Use of confidential data can be a complicated process. We want to help you avoid inadvertent violations of the HCUP Data Use Agreement. Certain restrictions on the use of HCUP data exist to prevent the violation of individual and institutional privacy rights.

  • Do not use the data for commercial or competitive purposes (e.g., competitive marketing or competitive contracting), or to determine the rights, benefits, or privileges of individual establishments. For example, activities such as analyzing the capacity or financial structure of an individual hospital for contracting purposes is prohibited. HCUP data may only be used for research, analysis and aggregate statistical reporting. Using HCUP data to gain market advantage is prohibited.

    • Data Use Restrictions DUA Excerpt 1

      "I will not use and will take all necessary and reasonable precautions to prohibit others from using the data set concerning individual establishments: (1) for commercial or competitive purposes involving those individual establishments; or (2) to determine the rights, benefits, or privileges of individual establishments."


  • Do not post HCUP data online. If you are seeking to use the data for any online application, please seek guidance from AHRQ on your specific project.

    • Data Use Restrictions DUA Excerpt 2

      "I will not redistribute HCUP data by posting on any Web site or other publically-accessible online repository."


  • Do not contact any institution to verify the data within the HCUP data sets.

    • Data Use Restrictions DUA Excerpt 3

      "I will not contact and will take all necessary and reasonable precautions to prohibit others from contacting establishments identified in the data set to question, verify, or discuss data in the HCUP databases."
Scenario 3:

Lisa: "Lakeview Hospital. This is Lisa speaking."

Stephen: "Hi Lisa, my name is Stephen Gossling. I am a health care researcher with Burnside University. I am using HCUP data to research the prevalence of newborn respiratory illnesses within the western United States. I have some questions about your data on newborn respiratory illness and would like to verify the number of cases that were admitted to your hospital three years ago."

Narrator: "Which of the following is a violation of the HCUP DUA? (Choose all that apply)."

  1. Contacting an institution to question, verify, or discuss HCUP data
  2. Identifying individuals within HCUP data
  3. Linking HCUP data to the Health Resources and Services Administration's Area Resource File
  4. Comparing (benchmarking) results from the HCUP data to another data source
Select this link for the answer to Scenario 3: Scenario 3 Answer

Return to Contents


8. HIPAA


The HIPAA Privacy Rule sets national standards for patient rights with respect to health information. This rule protects individually identifiable health information by establishing conditions for its use and disclosure by covered entities.

  • HCUP Data are Limited Data Sets

    HCUP databases conform to the definition of a limited data set. A limited data set is health care data in which 16 direct identifiers, specified in the Privacy Rule, have been removed.

    Under HIPAA, review by an institutional Review Board (IRB) is not required for use of limited data sets.


  • HCUP is Consistent with HIPAA Regulations

    The HCUP DUA is consistent with HIPAA requirements for use of a limited data set.


Further information on the HIPAA Privacy Rule can be found at: www.hhs.gov/ocr/hipaa or http://privacyruleandresearch.nih.gov/.

Return to Contents


9. Publishing Recommendations


AHRQ and its HCUP Partners must demonstrate that HCUP data are used to generate significant research contributions. Therefore, it is crucial to properly cite and acknowledge AHRQ and the specific HCUP databases used in your publication.

Suggested citations for HCUP databases and tools can be found on the HCUP-US Web site.

Publishing Recommendations DUA Excerpt

I will acknowledge in all reports based on these data that the source of the data is the "[cite specific database], Healthcare Cost and Utilization Project (HCUP), Agency for Healthcare Research and Quality."

Return to Contents


10. Summary and Review


During this course, you have learned the importance of adhering to the regulations outlined in the Data Use Agreement, which benefits patients and healthcare providers, AHRQ, HCUP data Partners, and you.

HCUP and AHRQ

HCUP is a family of health care databases and related software tools and products developed through a Federal-State-Industry partnership and sponsored by the Agency for Healthcare Research and Quality. HCUP data contain confidential information describing the clinical condition of individuals and the medical care received. It is essential to provide safeguards for such data in order to protect the privacy of individuals. This emphasis on protection also helps to ensure that HCUP data remain available for future health care research.

Importance of Adherence

It is important for you to understand the confidential nature of HCUP data and what you can and cannot do with it. Everyone given access to the HCUP data must sign a DUA which outlines how the data may be used and complete the online Data Use Agreement Training Course at www.hcup-us.ahrq.gov/tech_assist/dua.jsp. Civil or criminal penalties will be enforced for anyone who violates the requirements of the HCUP DUA.

Protection of Individual Identity
  • Do not release or disclose any data where the number of observations in any given cell of tabulated data is less than or equal to 10. Report only counts of 11 or more.
  • Do not attempt to identify individuals within the HCUP data sets, including patients and providers.
  • Do not attempt to learn the identity of individuals through any deliberate technical analysis, including through vulnerability analysis or penetration testing of the data.
  • Do not publish methodology that could be used by others to identify individuals.
Restrictions on Hospital Identification

Hospital identification is available in many state-level databases for research purposes. Do not publish or disclose the identity of these institutions.

Appropriate Use of Data

You are responsible for how you and others use the data to which you have access. You may:
  • Use the data for research, analysis, and aggregate statistical reporting.
  • Share the data with your immediate research group, if all members have signed and agree to adhere to the statutes of the DUA.
  • Merge outside data to HCUP data to conduct health care research as long as you do not attempt to identify individuals within HCUP data sets.
Use Restrictions

You are prohibited by the HCUP DUA from:

  • Using the data for commercial or competitive purposes.
  • Using the data to determine the rights, benefits, or privileges of individual establishments.
  • Redistributing HCUP data by posting data online.
  • Contacting an institution to question, verify, or discuss the data.
HIPAA

The HCUP DUA is consistent with HIPAA requirements for use of a limited data set.

Publishing Recommendations

It is important that you properly acknowledge AHRQ and the specific databases used in your publication.

Return to Contents


11. Conclusion


Congratulations! You have completed the HCUP Data Use Agreement course.

This course has discussed the key elements of the Data Use Agreements, but does not include every requirement. Please read the DUA thoroughly before signing it. The HCUP DUAs can be accessed on the HCUP-US Web site.

You only need to take this course once. If you obtain or use additional HCUP data in the future, you will be required to sign another DUA, but you will not need to complete this course again.

Data purchasers: If you are purchasing HCUP data, use the unique certification code to enable your Account in the online HCUP Central Distributor. You will be required to execute the DUA electronically during the ordering process.

Others with access to HCUP data: The training certification code and signed DUA for collaborators or others with access to HCUP data under the primary purchaser's agreement should be submitted directly to the HCUP Central Distributor to authorize your use of the data. The address is:

HCUP Central Distributor Social & Scientific Systems, Inc.
8757 Georgia Avenue, 12th Floor
Silver Spring, MD 20910
FAX: 866-792-5313
Email: HCUPDistributor@AHRQ.gov

It is highly recommended you print this certificate and keep it for your reference, as you may be asked to submit a copy to verify completion of the course. To verify you have completed the course, type your full name here , then select the link to print your certificate. For the best results please print the certificate in landscape orientation.
Print Certificate.

Important! Make note of your certification code: HCUP- found on your certificate.



Save your certificate for your records.

Make sure your completion certificate saves correctly before you close this course. This is your only chance to save this certificate.

If you are having difficulty with this course, please contact HCUP Technical Assistance staff at hcup@ahrq.gov for assistance or call (toll-free) 1-866-290-HCUP (4287).

Return to Contents


Answers


4. Protection of Individual Identities: Scenario 1

Question 1 = c. No, this would be in violation of the HCUP DUA.

The HCUP DUA stipulates that all published results must be reported with cell sizes greater than 10. One or two cases of a rare medical condition in a given geographic area are too few to report while preserving confidentiality. Cell sizes fewer than or equal to 10 could inadvertently reveal identity. These cases will need to be reported by combining the geographic areas up to a cell size greater than 10. Report only counts of 11 or more.

To return to Section 4, Return to Section 4

Return to Contents


Answers


6. Appropriate Use of Data: Scenario 2

Question 1 = a. Each of his colleagues must complete the online Data Use Agreement training course. b Each of his colleagues must read and sign the HCUP Data Use Agreement c Tom must send the online training completions certificates and signed DUAs for each of his colleagues to the Central Distributor and d Tom must ensure that the data is kept in a secured environment and that only authorized users will have access to the data.

HCUP data may be shared, but the original data purchaser is responsible for ensuring that the data are secure. Physical media must be kept in locked storage; data may be stored on secure servers at your institution as long as access is restricted to authorized data users. Only authorized users who have completed the online Data Use Agreement training, signed the Data Use Agreement, and submitted those documents to the HCUP Central Distributor may have access to the data.

To return to Section 6, select this link: Return to Section 6

Return to Contents


Answers


7. Data Use Restrictions: Scenario 3

Question 1 = a. Contacting an institution to question, verify, or discuss HCUP data b. Identifying individuals within HCUP data

Stephen's actions are in violation of the HCUP DUA. Stephen cannot contact an institution to question, verify, or discuss HCUP data, or to identify individuals within the data. However, Stephen can link HCUP data to additional data sources, such as the Health Resources and Services Administration's Area Resource File. Stephen may also benchmark his results from HCUP data to another data source.

To return to the Section 7, select this link: Return to Section 7

Return to Contents


Resources

Helpful Links:

Clicking on these links will open a new window.

Return to Contents


This course may not be copied, photocopied, reproduced, translated, transmitted, or electronically converted in whole or in part without the prior written consent of the Agency for Healthcare Research and Quality (AHRQ).

Created by Allen Communication Learning Services for the Agency for Healthcare Research and Quality (AHRQ), (866) 310-7800

Internet Citation: DUA Training - Accessible Version. Healthcare Cost and Utilization Project (HCUP). September 2017. Agency for Healthcare Research and Quality, Rockville, MD. www.hcup-us.ahrq.gov/DUA/dua_508/DUA508version.jsp.
Are you having problems viewing or printing pages on this Website?
If you have comments, suggestions, and/or questions, please contact hcup@ahrq.gov.
Privacy Notice, Viewers & Players
Last modified 9/6/17