Healthcare Clinical Research mCDA

Healthcare Clinical Research mCDA

This Clinical Data Agreement (mCDA) is entered into by and between Sponsor Name: and Institution Name: . Effective Date:

1. Purpose and Scope

The parties agree to share and use clinical data for the research study described below subject to the terms and conditions herein. The purpose of data sharing, permitted uses, and dataset identifiers are constrained to support legitimate research activities approved by the applicable institutional review board and to comply with applicable privacy and security laws.

2. Definitions

For purposes of this mCDA: "Protected Health Information" or "PHI" means individually identifiable health information governed by privacy laws; "De-identified Data" means data that have been stripped of identifiers so that individuals are not reasonably identifiable; "Data Recipient" means the receiving party; "Data Provider" means the party disclosing the data.

3. Data Elements to Be Shared

The parties shall specify the categories of data to be exchanged. Check all categories that apply:

Demographics (e.g., name, DOB, gender)
Clinical notes and encounter summaries
Laboratory results
Imaging metadata (not raw images unless agreed)
Genomic / sequencing data
Other:

4. Representative Patient Record Fields

When PHI is disclosed under this agreement, the following patient contact and demographic information fields shall be available only as required and in accordance with applicable law.

5. Insurance and Billing Data (If included)

6. Relevant Medical History

7. Use, Confidentiality and Security

Data Recipient agrees to use shared data solely for the research purposes described in this mCDA and to maintain administrative, physical and technical safeguards to protect the confidentiality, integrity and availability of the data. The Data Recipient shall restrict access to authorized personnel who have executed confidentiality obligations at least as protective as those herein.

8. HIPAA, De-identification and Authorization

Each party represents that it will comply with applicable privacy laws including requirements for PHI. When required by law or agreed herein, data shall be de-identified in accordance with accepted standards prior to disclosure. Where disclosure of PHI requires patient authorization, the parties shall obtain and retain valid written authorization consistent with the permitted uses and an expiration date.

9. Transfer, Storage, Retention and Destruction

Data transfers shall employ industry standard encryption in transit and at rest. The Data Recipient shall retain data only for the retention period necessary to complete the permitted research activities and as required by law, then securely destroy or return the data and certify destruction upon request.

Data Provider requires written certification of secure destruction within thirty (30) days of destruction.

10. Breach Notification and Audit

Each party shall promptly notify the other upon discovery of any security incident or unauthorized disclosure affecting shared data and shall cooperate in mitigation and required notifications. Data Provider retains the right to audit Data Recipient's compliance with security and privacy obligations, subject to reasonable notice and scope limitations.

Audit rights acknowledged:

11. Publications, Intellectual Property and Prior Review

Publications based on shared data shall credit data sources as agreed. Parties may require prior review of manuscripts to protect confidential or proprietary information; such review shall be limited to identifying confidential information and shall not unreasonably delay publication.

Prior review required:

12. Indemnification, Liability and Insurance

Each party shall indemnify and hold harmless the other for claims arising from its own breach of the agreement, negligent acts, or willful misconduct. The parties' aggregate liability shall be limited to direct damages and may be capped as mutually agreed below.

13. Term, Termination and Notice

This mCDA commences on the Effective Date and continues until terminated by either party upon written notice. Termination does not relieve obligations incurred prior to termination, including obligations to destroy or return data and complete reporting.

14. Governing Law and Dispute Resolution

This agreement shall be governed by the laws of the jurisdiction chosen by the parties. Parties shall attempt to resolve disputes in good faith through negotiation and, if necessary, mediation prior to litigation.

15. Miscellaneous Provisions

Entire Agreement: This mCDA constitutes the entire agreement between the parties regarding data sharing for the specified study. Amendments must be in writing and signed by authorized representatives. Severability: If any provision is found unenforceable, the remainder remains in effect.

Sign Now