CMS-R-235 DUA Certificate of Disposition

CERTIFICATE OF DISPOSITION (COD)
FOR DATA ACQUIRED FROM THE CENTERS FOR MEDICARE AND MEDICAID SERVICES (CMS)

Requester

Must match the individual specified in the DUA.

Requesting Organization

Must match the organization specified in the DUA.

Study Title

Must match the study title specified in the DUA.

DUA/Disclosure #

GENERAL INSTRUCTIONS

The DUA Requester or Custodian must complete this certificate if they wish to:
•
•

Close certain files on the DUA/Disclosure but leave the DUA/Disclosure and the remainder of its file open; or
Close the entire DUA/Disclosure

By completing this certificate, the DUA Requester or Custodian certifies that the organization has
destroyed/discontinued use of CMS data specified on this form at all locations. This includes any original files, copies,
derivatives or subsets, and any back-ups. The organization may not retain any copies, derivatives or manipulated files
unless approved by CMS for re-use. The organization may retain data containing aggregated and de-identified results
that meet the cell suppression policy.
Please ensure the organization has completed one of the following approved methods to dispose of CMS data:
• Clearing - at least one overwrite using a fixed data value, such as all zeros (0x00000000). Multiple write passes or
more complex values may optionally be used.
• Purging - degauss with an organizationally approved degausser rated at a minimum for the media. Other ways to
purge for hard disk drives include the overwrite EXT command. Apply one write pass of a fixed pattern across
the media surface or apply the cryptographic erase if it is supported by a hard drive.
• Destroy - shred, disintegrate, pulverize, or incinerate by burning the device in an incinerator.

SECTION 1 - DATA DISPOSITION

I am closing the entire DUA/Disclosure and all associated files. (Choose one option below.)
I received physical data files. (Complete section 2)
I received no physical data, and data was only accessed through CMS systems. (Skip to section 3)
I am only closing certain files on the DUA/Disclosure, but leaving the DUA/Disclosure open. (Complete section 2)

1

CERTIFICATE OF DISPOSITION (COD)
FOR DATA ACQUIRED FROM THE CENTERS FOR MEDICARE AND MEDICAID SERVICES (CMS)
SECTION 2 – DISPOSITION STATEMENT
Please specify the letter associated with the disposition statement in the table for each file listed. To close a DUA with physical data
files, each file must be listed, including those accessed through CMS systems.
A.
B.
C.
D.

The file has been destroyed, including copies, derivatives, subsets, and manipulated files.
The file or copies, derivatives, subsets, and/or manipulated files have been approved by CMS for re-use.
The file was accessed directly through CMS systems. (I did not receive a physical copy of the data.)
The file was not received.

Disposition

File(s)

Year(s)

SECTION 3 – DISPOSITION CONFIRMATION
As a Requester or Data Custodian, I confirm that the files indicated on this form have been disposed of in accordance with
the terms and conditions found on the DUA/Disclosure Agreement.
Printed Name

Email

Signature

Phone #

Date
2