PHI & Data
Data Use Agreement (DUA)
A contract governing how a limited data set may be used and disclosed.
A Data Use Agreement (DUA) is a contract required whenever a covered entity or business associate shares a Limited Data Set. It establishes who may use the data, for what purposes, and the safeguards the recipient must apply.
A DUA is distinct from a Business Associate Agreement (BAA): a BAA governs vendors handling full PHI, while a DUA covers the narrower, partly de-identified Limited Data Set.