2 HCUP DUA for the Nationwide Databases

DATA USE AGREEMENT for the
Nationwide Databases from the
Healthcare Cost and Utilization Project
Agency for Healthcare Research and Quality

This Data Use Agreement (“Agreement”) governs the disclosure and use of data in the HCUP Nationwide
Databases from the Healthcare Cost and Utilization Project (HCUP) which are maintained by the Agency for
Healthcare Research and Quality (AHRQ). The HCUP Nationwide databases include the National (Nationwide)
Inpatient Sample (NIS), Kids’ Inpatient Database (KID), Nationwide Ambulatory Surgery Sample (NASS),
Nationwide Emergency Department Sample (NEDS), and Nationwide Readmissions Database (NRD). Any
person (“the data recipient”) seeking permission from AHRQ to access HCUP Nationwide Databases must sign
and submit this Agreement to AHRQ or its agent, and complete the online Data Use Agreement Training Course
at www.hcup-us.ahrq.gov, as a precondition to the granting of such permission.
Section 944(c) of the Public Health Service Act (42 U.S.C. 299c-3(c)) (“the AHRQ Confidentiality Statute”),
requires that data collected by AHRQ that identify individuals or establishments be used only for the purpose for
which they were supplied. Pursuant to this Agreement, data released to AHRQ for the HCUP Databases are
subject to the data standards and protections established by the Health Insurance Portability and Accountability
Act of 1996 (HIPAA) (P.L. 104-191) and implementing regulations (“the Privacy Rule”). Accordingly, HCUP
Databases may only be released in “limited data set” form, as that term is defined by the Privacy Rule, 45 C.F.R.
§ 164.514(e). AHRQ classifies HCUP data as protected health information under the HIPAA Privacy Rule, 45
C.F.R. § 160.103. By executing this Agreement, the data recipient understands and affirms that HCUP data may
only be used for the prescribed purposes, and consistent with the following standards:
No Identification of Persons–The AHRQ Confidentiality Statute prohibits the use of HCUP data to identify
any person (including but not limited to patients, physicians, and other health care providers). The use of HCUP
Databases to identify any person constitutes a violation of this Agreement and may constitute a violation of the
AHRQ Confidentiality Statute and the HIPAA Privacy Rule. This Agreement prohibits data recipients from
releasing, disclosing, publishing, or presenting any individually identifying information obtained under its terms.
AHRQ omits from the data set all direct identifiers that are required to be excluded from limited data sets as
consistent with the HIPAA Privacy Rule. AHRQ and the data recipient(s) acknowledge that it may be possible for
a data recipient, through deliberate technical analysis of the data sets and with outside information, to attempt to
ascertain the identity of particular persons. Risk of individual identification of persons is increased when
observations (i.e., individual discharge records) in any given cell of tabulated data is ≤10. This Agreement
expressly prohibits any attempt to identify individuals, including by the use of vulnerability analysis or penetration
testing. In addition, methods that could be used to identify individuals directly or indirectly shall not be disclosed,
released, or published. Data recipients shall not attempt to contact individuals for any purpose whatsoever,
including verifying information supplied in the data set. Any questions about the data must be referred exclusively
to AHRQ. By executing this Agreement, the data recipient understands and agrees that actual and considerable
harm will ensue if he or she attempts to identify individuals. The data recipient also understands and agrees that
actual and considerable harm will ensue if he or she intentionally or negligently discloses, releases, or publishes
information that identifies individuals or can be used to identify individuals.
Use of Establishment Identifiers–The AHRQ Confidentiality Statute prohibits the use of HCUP data to
identify establishments unless the individual establishment has consented. Permission is obtained from the HCUP
data sources (i.e., state data organizations, hospital associations, and data consortia) to use the identification of
hospital establishments (when such identification appears in the data sets) for research, analysis, and aggregate
statistical reporting. This may include linking institutional information from outside data sets for these purposes.
Data recipients are prohibited from identifying establishments directly or by inference in disseminated material. In
addition, users of the data are prohibited from contacting establishments for the purpose of verifying information
supplied in the data set. Any questions about the data must be referred exclusively to AHRQ. Misuse of
identifiable HCUP data about hospitals or any other establishment constitutes a violation of this Agreement and
may constitute a violation of the AHRQ Confidentiality Statute.

Data Use Agreement for HCUP Nationwide Databases

1

8/20/2023

Unauthorized Uses of HCUP Data–Data recipients may only use HCUP data sets for research, analysis
and aggregate statistical reporting projects. AHRQ does not authorize the use of HCUP data for commercial or
competitive purposes affecting establishments; to determine the rights, benefits, or privileges of individuals or
establishments; for criminal and civil litigation, including expert witness testimony; for law enforcement activities;
or for any other purpose incompatible with the AHRQ Confidentiality Statute and HCUP data project.
The undersigned data recipients provide the following assurances concerning HCUP data:
Protection of Individuals
·

I will not release or disclose, and will take all necessary and reasonable precautions to prohibit others from
releasing or disclosing, any information that directly or indirectly identifies persons. This includes attempts to
identify individuals through the use of vulnerability analysis or penetration testing.

·

I acknowledge that the release or disclosure of information where the number of observations (i.e., individual
discharge records) in any given cell of tabulated data is ≤10 can increase the risk for identification of persons.
I will consider this risk and avoid publication of values of 1-10 in text and tables.

·

I will not attempt to link, and will prohibit others from attempting to link, the discharge records of persons in
the data set with individually identifiable records from any other source.

·

I will not attempt to use and will take all necessary and reasonable precautions to prohibit others from using
the data set to contact any persons in the data for any purpose.

Protection of Establishments
·

I will not publish or report, through any medium, data that could identify individual establishments directly or
by inference.

·

When the identities of establishments are not provided in the data sets, I will not attempt to use and will take
all necessary and reasonable precautions to prohibit others from using the data set to learn the identity of any
establishment.

·

I will not contact and will take all necessary and reasonable precautions to prohibit others from contacting
establishments identified in the data set to question, verify, or discuss data in the HCUP databases.

Limitations on Data Use, Sharing, and Disclosure
·

I will not use or disclose, and I will prohibit others from using or disclosing the data set, or any part thereof,
except for research, analysis, and aggregate statistical reporting, and only as permitted by this Agreement.

·

I will not use the data set, and I will prohibit others from using the data set, for unauthorized purposes. AHRQ
does not authorize the use of HCUP data for commercial or competitive purposes affecting establishments;
to determine the rights, benefits, or privileges of individuals or establishments; for criminal and civil litigation,
including expert witness testimony; for law enforcement activities; or for any other purpose incompatible with
the AHRQ Confidentiality Statute and the HCUP data project. If there is any question regarding whether an
intended use of the data set is prohibited, I agree to contact the AHRQ HCUP program for advice prior to
engaging in or permitting such use.

·

I will not redistribute HCUP data by posting on any website or publishing in any other publicly accessible
online repository. If a journal or publication requests access to data or analytic files, I will cite restrictions on
data sharing in this Data Use Agreement and direct them to AHRQ HCUP (www.hcup-us.ahrq.gov) for more
information on accessing HCUP data.

·

I acknowledge that the HCUP NIS, KID, and NRD may contain data elements from proprietary restricted
computer software (e.g., 3MTM APR DRGs) supplied by private vendors to AHRQ for the sole purpose of
supporting research and analysis with the HCUP NIS, KID, and NRD. While I may freely use these data
elements in my research work using the HCUP NIS, KID, and NRD I agree that I will not use and will prohibit
others from using these proprietary data elements for any other purpose. In addition, I will enter into a

Data Use Agreement for HCUP Nationwide Databases

2

8/20/2023

separate agreement with the appropriate organization or firm for the right to use such proprietary data
elements for commercial purposes. In particular, I agree not to disassemble, decompile, or otherwise reverseengineer the proprietary software, and I will prohibit others from doing so.
Safeguards
·

I will ensure that the data are kept in a secured environment and that only authorized users will have access
to the data.

·

I will only allow access to HCUP Nationwide data to those who have become authorized users of the HCUP
data by signing a copy of this Data Use Agreement and completing the online Data Use Agreement Training
Course at www.hcup-us.ahrq.gov. Before granting any individual access to the data set, I will submit the
signed data use agreements to the HCUP Central Distributor.

Responsibility
·

I acknowledge and affirm that I am personally responsible for compliance with the terms of this Agreement,
to the exclusion of any other party, regardless of such party’s role in sponsoring or funding the research that
is the subject of this Agreement.

·

I acknowledge and affirm that interpretations, conclusions, and/or opinions that I reach as a result of my
analyses of the data sets are my interpretations, conclusions, and/or opinions, and do not constitute the
findings, policies, or recommendations of the U.S. Government, the U.S. Department of Health and Human
Services, or AHRQ.

·

I agree to acknowledge in all reports based on these data that the source of the data is the “National Inpatient
Sample (NIS), Healthcare Cost and Utilization Project (HCUP), Agency for Healthcare Research and Quality.”
Substitute “Nationwide Inpatient Sample (NIS)” (if using data prior to 2012), “Kids’ Inpatient Database (KID),”
“Nationwide Ambulatory Surgery Sample (NASS),” “Nationwide Emergency Department Sample (NEDS),” or
“Nationwide Readmissions Database (NRD)” as appropriate.

·

I will indemnify, defend, and hold harmless AHRQ and the data organizations that provide data to AHRQ for
HCUP from any or all claims and losses accruing to any person, organizations, or other legal entity as a result
of violation of this Agreement. This provision applies only to the extent permitted by Federal and State law.

·

I agree to report the violation or apparent violation of any term of this Agreement to AHRQ without
unreasonable delay and in no case later than 30 calendar days of becoming aware of the violation or apparent
violation.

Terms, Breach, and Compliance
Any violation of the terms of this Agreement shall be grounds for immediate termination of this Agreement. AHRQ
shall determine whether a data recipient has violated any term of the Agreement. AHRQ shall determine what
actions, if any, are necessary to remedy a violation of this Agreement, and the data recipient(s) shall comply with
pertinent instructions from AHRQ. Actions taken by AHRQ may include but not be limited to providing notice of
the termination or violation to affected parties and prohibiting data recipient(s) from accessing HCUP data in the
future.
In the event AHRQ terminates this Agreement due to a violation, or finds the data recipient(s) to be in violation of
this Agreement, AHRQ may direct that the undersigned data recipient(s) immediately return all copies of the HCUP
Nationwide Databases to AHRQ or its designee without refund of purchase fees.

Data Use Agreement for HCUP Nationwide Databases

3

8/20/2023

Acknowledgment
I understand that this Agreement is requested by the United States Agency for Healthcare Research and Quality
to ensure compliance with the AHRQ Confidentiality Statute. My signature indicates that I understand the terms
of this Agreement and that I agree to comply with its terms. I understand that a violation of the AHRQ
Confidentiality Statute may be subject to a civil penalty of up to $16,443 under 42 U.S.C. 299c-3(d), and that
deliberately making a false statement about this or any matter within the jurisdiction of any department or agency
of the Federal Government violates 18 U.S.C. § 1001 and is punishable by a fine, up to five years in prison, or
both. Violators of this Agreement may also be subject to penalties under state confidentiality statutes that apply
to these data for particular states.
Signed:

Date:

Print or Type Name:
Organization:

Title:

Street Address:
City:

State/Province/Region:

Postal/ZIP Code:

Country:

Email:

Phone:

The information above is maintained by AHRQ only for the purpose of enforcement of this Agreement and for
notification in the event data errors occur.
Note to data purchasers: Shipment of the requested data product will only be made to the person who signs this
Agreement, unless special arrangements that safeguard the data are made with AHRQ or its agent.
Submission Information
Signed HCUP Data Use Agreements and proof of online training must be submitted to the HCUP
Central Distributor for AHRQ’s records. Refer to the Central Distributor page on the HCUP User Support
website at https://hcup-us.ahrq.gov/tech_assist/centdist.jsp for instructions.
Alternatively, send signed HCUP Data Use Agreements and proof of online training to:
HCUP Central Distributor
E-mail: HCUP-RequestData@AHRQ.gov
If an alternative option for submission is needed, please contact HCUP Central
Distributor at HCUP-RequestData@AHRQ.gov.

Collection of this information is required as a condition of access to Healthcare Cost and Utilization Project data products. The
information collection supports requirements of the Public Health Service Act (42 U.S.C. 299c-3(c)), and is used for 1) completion of
order transactions, and 2) for enforcement of the HCUP Data Use Agreement. As required by the Privacy Act of 1974, any identifying
information obtained will be kept private to the extent provided by law. Public reporting burden for this collection of information is
estimated to average 5 minutes per response, the estimated time required to review and sign this Data Use Agreement. An agency
may not conduct or sponsor, and a person is not required to respond to, a collection of information unless it displays a currently valid
OMB control number. Send comments regarding this burden estimate or any other aspect of this collection of information, including
suggestions for reducing this burden, to: AHRQ Reports Clearance Officer Attention: PRA, Paperwork Reduction Project (0935-0206)
AHRQ, 5600 Fishers Lane, # 07W41A, Rockville, MD 20857.
OMB Control No. 0935-0206 expires 05/31/2025.
Data Use Agreement for HCUP Nationwide Databases

4

8/20/2023