Track Change - RIF COD

CERTIFICATE OF DISPOSITION (COD)
FOR DATA ACQUIRED FROM THE CENTERS FOR MEDICARE AND MEDICAID SERVICES (CMS)
DUA Requester

Must match the individual specified in the DUA.

Requesting Organization

Must match the organization specified in the DUA.

Study Title

Must match the study title specified in section 3 of the DUA.

DUA #

GENERAL INSTRUCTIONS

The DUA Requester or Data Custodian must complete this certificate if they wish to:
•
•
•

Close certain files on the DUA but leave the DUA and the remainder of its files open;
Document destruction of physical media; or
Close the entire DUA

By completing this certificate, the DUA Requester or Data Custodian certifies that the Requesting Organization
has destroyed/discontinued use of CMS data specified on this form at all locations. This includes any original files,
copies, derivatives or subsets, and any back-ups. The Requesting Organization may not retain any copies,
derivatives or manipulated files unless approved by CMS for use on another open CMS DUA. The Requesting
Organization may retain data that is de-identified under the HIPAA Privacy Rule as described at 45 CFR 164.514(b) and
adheres to CMS policy for cell size suppression.
Please ensure the Requesting Organization has completed one of the following approved methods to dispose of CMS
data:
•
•

•

Clearing - overwrite media by using organizationally approved and validated overwriting
technologies/methods/tools. The clear pattern should be at least a single write pass with a fixed data value,
such as all zeros. Multiple write passes or more complex values may optionally be used.
Purging - degauss with an organizationally approved degausser rated at a minimum for the media. Other
methods of purging include overwrite, block erase, and cryptographic erase through the use of dedicated,
standardized device sanitize commands that apply media-specific techniques to bypass the abstraction inherent
in typical read and write commands.
Destroy - shred, disintegrate, melt, pulverize, or incinerate by burning the device in a licensed incinerator.

SECTION 1 - DATA DISPOSITION

I am closing the entire DUA and all associated files. (Choose one option below.)
I received physical data files. (Complete section 2)
I received no physical data, and data was only accessed through CMS systems. (Skip to section 3)
I am only closing certain files on the DUA, butDUA but leaving the DUA open. (Complete section 2)
I am destroying the physical media but leaving the DUA open. (Complete section 2)
Other – Must be preapproved by CMS. Provide preapproved language below.

Formatted: Indent: Left: 0"

OMB No. 0938-0734. Exp. 10/31/2025

1

CERTIFICATE OF DISPOSITION (COD)
FOR DATA ACQUIRED FROM THE CENTERS FOR MEDICARE AND MEDICAID SERVICES (CMS)
SECTION 2 – DISPOSITION STATEMENT
Please specify the letter associated with the disposition statement in the table column titled “Disposition” for each file listed. Include
the associated data file EPPE code in the table column titled “File(s)”. To close a DUA with physical data files, each file must be listed,
including those accessed through CMS systems.
A.
B.
C.

The file has been destroyed, including copies, derivatives, subsets, and manipulated files.
The file or copies, derivatives, subsets, and/or manipulated files have been approved by CMS for use on another
open CMS DUA through reuse. Include the reuse DUA number for each file.
The file was accessed directly through CMS systems. (I did not receive a physical copy of the data.)

Disposition

File(s)

Year(s)

SECTION 3 – DISPOSITION CONFIRMATION
As a Requester or Data Custodian, I confirm on behalf of the Requesting Organization that the files indicated on this form
have been disposed of in accordance with the terms and conditions found on the DUA.

Printed Name

Signature Email

EmailSignature

Phone #Date

DatePhone #

2