Here at the University of Maryland, we pride ourselves on being one of the top public research universities within the nation. With over 4,500 researchers across 12 different schools and colleges, our research spans a wide range of disciplines–from engineering and computer sciences to public health, social sciences, and the humanities. What comes to mind when you think about what is involved in research? The actual researchers, data to analyze, legal requirements… Did you think about a data use agreement? Regardless, we are going to cover why data use agreements (DUA’s) are important and when they are necessary.
A data use agreement is a contract that outlines the requirements of how data must be handled (who should have access to it, how it needs to be secured, how long it can be retained, etc.). These contracts are required specifically when the data involved is considered protected health information, and the data being shared is a limited data set (thank you, HIPAA Privacy Rule!)
Another scenario where DUAs may be used is when data is being shared between more than one organization, such as a team of researchers at UMD with a team of researchers from any other non-UMD entity. Through a data use agreement, the data provider can maintain contractual control over how the data is being handled. This can help substantially limit the risk of unauthorized exposure by outlining the expectations for storage, retention, and access to the data.
When executing a data use agreement, the following should be addressed:
- Description of the data
- The purpose of the research
- Security requirements for the handling of the data
- The term of the agreement and termination of the agreement
- Audit rights
- Indemnification
- Governing law
When you are starting a new research project at UMD, you will receive guidance on what contracts are needed, and there will be reviews of the language from both the Office of Research Administration and the Privacy Office. From these reviews you can expect to receive feedback on whether language needs to be tweaked in any way or guidance on what systems are best suited to house the data received. Likewise, if we are the party sharing data, the same process will occur, and you can expect feedback about what the appropriate privacy, security, and legal expectations are for the entity receiving the data.
If you have questions about this process, please contact ora@umd.edu or sparcs@umd.edu.
For a data use agreement template, visit the ORA website.