Healthcare Sponsor CDA

HEALTHCARE SPONSOR CONFIDENTIALITY AND DATA ACCESS AGREEMENT

This Confidentiality and Data Access Agreement (the Agreement) is entered into by and between:

Sponsor Name:     Healthcare Provider / Institution Name:

Effective Date:

Recitals

WHEREAS, Sponsor desires access to certain clinical and administrative data maintained by the Healthcare Provider for the purpose of clinical research, regulatory submissions, or aggregate analysis as described in this Agreement; and

WHEREAS, Healthcare Provider is willing to disclose such data under the terms set forth in this Agreement and consistent with applicable law, including privacy and data protection requirements.

Definitions

"Confidential Information" means non-public information disclosed by one party to the other, whether oral, written or electronic, including without limitation proprietary business information, study protocols, datasets, and patient-level health information not in the public domain.

"Personal Data" or "Protected Health Information (PHI)" means individually identifiable health information as defined under applicable law. To the extent any PHI is disclosed, Provider shall document lawful basis and patient authorization as required hereunder.

"De-identified Data" means data from which identifiers have been removed in accordance with a de-identification methodology described by the parties and consistent with applicable law so that the data cannot reasonably be used to re-identify an individual.

Scope of Data Transfer

The Healthcare Provider will disclose the following categories of data to Sponsor. Sponsor represents that use of the data will be limited to the Permitted Uses specified in this Agreement.

Data Categories (select applicable):
De-identified data (no direct identifiers)    Limited PHI dataset (as agreed)    Patient-level identified data (only where authorized)

Dataset Description:

Patient Information (Representative Record)

If specific patient records are to be transferred, identify a representative record below. Provider shall not transfer identifiable patient records unless expressly selected above and authorized.

Insurance Information (If Included)

Medical History Summary (Representative)

Permitted Use and Restrictions

Sponsor shall use Confidential Information and any received data solely for Sponsor's internal research, regulatory submissions, and authorized analyses expressly described in the Dataset Description. Sponsor shall not attempt to re-identify de-identified data or use identifiable PHI for marketing or any purpose not expressly permitted herein.

Any publication of aggregated results shall not include information that could reasonably identify an individual. Sponsor shall provide Provider a reasonable opportunity to review proposed publications that reference Provider's data and shall acknowledge Provider as required by Provider's institutional policy.

Data Security, Privacy and Breach Notification

Sponsor shall implement and maintain appropriate administrative, technical and physical safeguards to protect Confidential Information and any PHI received, consistent with applicable law. Such safeguards shall include, at a minimum, access controls, encryption for data at rest and in transit, and logging of access to sensitive data.

In the event of any security incident or unauthorized disclosure affecting PHI or Confidential Information, the discovering party shall notify the other party without undue delay but no later than 72 hours after discovery, provide a description of the incident and take commercially reasonable steps to contain and remediate the incident.

Data Return, Retention and Destruction

Upon expiration or termination of this Agreement, Sponsor shall, at Provider's option, return or securely destroy all Confidential Information and PHI provided by Provider, including all copies, extracts and derivative materials, within thirty (30) days unless retention is required by law or regulatory obligation.

Authorization Expiration Date:

Representations, Indemnification and Limitation of Liability

Each party represents that it has authority to enter into this Agreement. Provider represents that it has obtained or documented any patient authorizations required for disclosure of identifiable PHI. Sponsor agrees to indemnify, defend and hold harmless Provider from and against any third-party claims arising from Sponsor's misuse of data or failure to safeguard data as required in this Agreement.

Neither party shall be liable to the other for indirect, incidental, special or consequential damages except to the extent caused by willful misconduct or gross negligence.

Audit, Compliance and Recordkeeping

Provider shall have the right to audit Sponsor's compliance with the terms of this Agreement with reasonable prior notice and during normal business hours. Sponsor shall maintain records demonstrating compliance for a period of three (3) years following termination or longer where required by law.

Notices and Governing Law

Notices shall be provided in writing to the addresses designated by each party. This Agreement shall be governed by the laws of the state specified below.

Miscellaneous

This Agreement constitutes the entire agreement between the parties with respect to its subject matter and supersedes all prior agreements and understandings. Any amendment or modification must be in writing and executed by authorized representatives of both parties.

Sign Now