RIF COD_JobAid

Instructions for completing the Certificate of Disposition (COD)
This document: The Requester or Data Custodian must complete the Certificate of Disposition (COD) to

close certain files on the Data Use Agreement (DUA) but leave the DUA and the remainder of its files open or if
they wish to close the entire DUA.

General Instructions

1. Answer every item in the document.
2. Do not alter the layout or content of the document.
3. Submit to CMS signed in PDF format.

A

AF
T

Specific Instructions

CERTIFICATE OF DISPOSITION (COD)
FOR DATA ACQUIRED FROM THE CENTERS FOR MEDICARE AND MEDICAID SERVICES (CMS)

B

Enter the exact legal name of the
Requesting Organization listed on the
DUA.

D

C

DUA Requester
A
Must match the individual specified in the DUA.
Requesting Organization
B
Must match the organization specified in the DUA.
Study Title
C
Must match the study title specified in section 3 of the DUA.
DUA #
D

GENERAL INSTRUCTIONS

The DUA Requester or Data Custodian must complete this certificate if they wish to:
•
•
•

Close the entire DUA and all associated files; or
Close certain files on the DUA but leave the DUA and the remainder of its files open; or
Document destruction of physical media

R

Enter the name of the Requester listed
on the DUA. The Requester is the individual authorized to sign agreements
on behalf of the requesting organization. This person is often referred to
as the ‘legal signatory’. This person
accepts all terms and conditions in the
DUA and attests that all information
contained in the request is accurate.

By completing this certificate, the DUA Requester or Data Custodian certifies that the Requesting Organization
has destroyed/discontinued use of CMS data specified on this form at all locations. This includes any original files,
copies, derivatives or subsets, and any back-ups. The Requesting Organization may not retain any copies,
derivatives or manipulated files unless approved by CMS for use on another open CMS DUA. The Requesting
Organization may retain data that is de-identified under the HIPAA Privacy Rule as described at 45 CFR 164.514(b) and
adheres to CMS policy for cell size suppression.

Please ensure the Requesting Organization has completed one of the following approved methods to dispose of CMS
data:
•

Enter the exact Study Title listed on
the DUA.

D

Enter the DUA number of the DUA you
wish to close. List only one DUA number per form.

•

•

Clearing - overwrite media by using organizationally approved and validated overwriting
technologies/methods/tools. The clear pattern should be at least a single write pass with a fixed data value,
such as all zeros. Multiple write passes or more complex values may optionally be used.
Purging - degauss with an organizationally approved degausser rated at a minimum for the media. Other
methods of purging include overwrite, block erase, and cryptographic erase through the use of dedicated,
standardized device sanitize commands that apply media-specific techniques to bypass the abstraction inherent
in typical read and write commands.
Destroy - shred, disintegrate, melt, pulverize, or incinerate by burning the device in a licensed incinerator.

SECTION 1 - DATA DISPOSITION

E

F

G

I am closing the entire DUA and all associated files. I am only closing certain
files on the DUA but leaving the DUA open. (Complete section 2)
I am destroying the physical media but leaving the DUA and all files open. (Complete section 2)

H

Other – Must be preapproved by CMS. Provide preapproved language below.

(Instructions continue on page 2)
Instructions for completing the Certificate of Disposition (COD) | page 1

OMB No. 0938-0734. Exp. 10/31/2025

1

E

CERTIFICATE OF DISPOSITION (COD)
FOR DATA ACQUIRED FROM THE CENTERS FOR MEDICARE AND MEDICAID SERVICES (CMS)

Check this box if you are closing the
entire DUA and all associated files.
Select the first option if you received
physical files and complete Section
2 - Disposition Statement. Select the
second option if you accessed the data
through CMS systems and received no
physical data and skip to Section 3 Disposition Confirmation.

F

G

The DUA Requester or Data Custodian must complete this certificate if they wish to:
•
•
•

Close the entire DUA and all associated files; or
Close certain files on the DUA but leave the DUA and the remainder of its files open; or
Document destruction of physical media

By completing this certificate, the DUA Requester or Data Custodian certifies that the Requesting Organization
has destroyed/discontinued use of CMS data specified on this form at all locations. This includes any original files,
copies, derivatives or subsets, and any back-ups. The Requesting Organization may not retain any copies,
derivatives or manipulated files unless approved by CMS for use on another open CMS DUA. The Requesting
Organization may retain data that is de-identified under the HIPAA Privacy Rule as described at 45 CFR 164.514(b) and
adheres to CMS policy for cell size suppression.

Please ensure the Requesting Organization has completed one of the following approved methods to dispose of CMS
data:
•
•

•

Clearing - overwrite media by using organizationally approved and validated overwriting
technologies/methods/tools. The clear pattern should be at least a single write pass with a fixed data value,
such as all zeros. Multiple write passes or more complex values may optionally be used.
Purging - degauss with an organizationally approved degausser rated at a minimum for the media. Other
methods of purging include overwrite, block erase, and cryptographic erase through the use of dedicated,
standardized device sanitize commands that apply media-specific techniques to bypass the abstraction inherent
in typical read and write commands.
Destroy - shred, disintegrate, melt, pulverize, or incinerate by burning the device in a licensed incinerator.

SECTION 1 - DATA DISPOSITION

E

F

G

I am closing the entire DUA and all associated files. I am only closing certain
files on the DUA but leaving the DUA open. (Complete section 2)
I am destroying the physical media but leaving the DUA and all files open. (Complete section 2)

H

Other – Must be preapproved by CMS. Provide preapproved language below.

R

Check this box if you are only destroying the physical media, but leaving the
DUA open. Complete Section 2 - Disposition Statement. CMS requires that all
shipped physical media be destroyed
once the data is uploaded into the
DMP SAQ approved environment.

H

GENERAL INSTRUCTIONS

AF
T

Check this box if you are only closing
certain files on the DUA, but leaving
the DUA open. Complete Section 2 Disposition Statement.

DUA Requester
A
Must match the individual specified in the DUA.
Requesting Organization
B
Must match the organization specified in the DUA.
Study Title
C
Must match the study title specified in section 3 of the DUA.
DUA #
D

D

Check this box if you have preapproved language provided by CMS.

Instructions for completing the Certificate of Disposition (COD) | page 2

OMB No. 0938-0734. Exp. 10/31/2025

1

I

CERTIFICATE OF DISPOSITION (COD)
FOR DATA ACQUIRED FROM THE CENTERS FOR MEDICARE AND MEDICAID SERVICES (CMS)

Enter the letter from the list above
which describes the disposition of
each file.

SECTION 2 – DISPOSITION STATEMENT
Please specify the letter associated with the disposition statement in the table column titled “Disposition” for each file listed. Include the
associated data file EPPE code in the table column titled “File(s)”. To close a DUA, each file must be listed.
The file has been destroyed, including copies, derivatives, subsets, and manipulated files.
The file or copies, derivatives, subsets, and/or manipulated files have been approved by CMS for use on another
open CMS DUA through reuse. Include the reuse DUA number for each file.
C. The file was accessed directly through CMS systems and the access has been removed for all users. (I did not receive
a physical copy of the data.)
D. Data files have been securely uploaded into our approved environment and the physical media received has been
destroyed. The DUA and all data files remain open.

A.
B.

J

List each data file name individually exactly as listed in the “Data File
Description” column of the DUA and
include the EPPE code. Generalized
statements to all files are not acceptable. Include the reuse DUA number
for each file.

I

File(s)

Year(s)

J

K

AF
T

K

Disposition

List the years for each individual data
file type. Years may be listed as a
range.

L

Print the signatory’s name. This is either the Requester or Data Custodian.

L

Printed Name

R

M

SECTION 3 – DISPOSITION CONFIRMATION

As a Requester or Data Custodian, I confirm on behalf of the Requesting Organization that the files and/or physical media
indicated on this form have been disposed of in accordance with the terms and conditions found on the DUA.

Sign the document. CMS will accept
digital signatures on this form.

D

N

Enter the date this form is signed.

M

Signature

O

Email

2

O

Enter the Requester or Data Custodian’s email address. CMS will not
accept personal email addresses (e.g.,
gmail.com or hotmail.com).

P

Enter the Requester or Data Custodian’s phone number.

Instructions for completing the Certificate of Disposition (COD) | page 3

N
Date

P
Phone #