§ 425.710 Data use agreement.

(a)

(1) Before receiving any beneficiary identifiable data, ACOs must enter into a DUA with CMS. Under the DUA, the ACO must comply with the limitations on use and disclosure that are imposed by HIPAA, the applicable DUA, and the statutory and regulatory requirements of the Shared Savings Program.