The DHA Privacy and Civil Liberties Office is responsible for ensuring that the release of DHA data complies with federal privacy laws, regulations, and Department of Defense policies. This includes the disclosure of data to a research repository. In general, a Data Sharing Agreement is an administrative control used by DHA to document that the requested use of data is in compliance with the previously mentioned federal laws and DOD policies. The DSA:
- Documents the responsibilities of the requestors, including the government sponsor and applicant/recipient
- Confirms that DHA data will be used as permitted or required
- Exercises administrative, technical, and physical safeguards to protect the privacy of PHI, as required by the Health Insurance Portability and Accountability Act
- Determines the HIPAA-defined category of data intended for use (i.e., protected health information, a limited data set, or de-identified PHI)
- HIPAA permits a covered entity to use or disclose a limited data set for research, public health, or health care operations purposes
- Maintains records to confirm compliance in case of an investigation
Note that the DHA PCLO doesn't provide data extractions or grant system access. The system managers who grant access to data require a DSA.
Who Needs a Data Sharing Agreement?
A DHA DSA or Data Use Agreement is needed if contractors or non-government researchers who wish to access Military Health System data, managed by DHA, for government-sponsored initiatives must obtain a DHA DSA or Data Use Agreement.
- Government personnel involved in research also need to obtain a DHA DSA or DUA. They are required to submit a DSA application, which must be approved before executing the DSA.
Government Only: A DSA isn't required for those requesting de-identified data provided as a third-party extract.
How Do I Request a DSA?
A DSA is requested by submitting a Data Sharing Agreement Application or a Prerequisite Checklist. These are endorsed by an applicant/requestor and a government sponsor. Once the DSAA is approved it becomes part of the executed agreement provided to the requestor and a government sponsor. Once a PRC is approved, a No Action Letter is issued once the compliance check has been completed.
To request a DSAA, a PRC, a DSA Renewal, or a DSAA Modification, email: dha.ncr.pcl.mbx.data-sharing@health.mil. You can also find these forms on Inside DHA (CAC-enabled).
Applicant Role
The applicant is the individual, usually a contractor, who has primary oversight and responsibility for the data.
- For projects involving subcontractors, even when the data is solely handled by subcontractors, the DSAA applicant must be an employee of the prime contractor.
- For projects with more than one prime contractor, a DSAA must be completed for each contracting organization that requires data for the project.
- The applicant is referred to as the recipient in the final approved DSA.
Applicant Responsibilities
Government Sponsor Role
The government sponsor is the point of contact who assumes responsibility for the project/data use described in the DSAA. This role can be filled by a civilian within the government or a uniformed service member.
Government Sponsor Responsibilities
Memorandum of Agreement and Memorandum of Understanding
The DHA PCLO serves as the main point of contact for data sharing requests, data sharing arrangements with private entities, and research projects. The DHA Agreements and Partnerships Management Office handles MOAs and MOUs for recurring data sharing arrangements with other DOD agencies, federal agencies, and state and local governments. The DHA PCLO and the DHA APMO have established a process for reviewing MOAs and MOUs which involve sharing PII/PHI.