System EGI shall require a person to agree to a Data Use Agreement prior to Disclosure of a Limited Data Set created or maintained by System to such a person.
6.4(1) Use and Disclosure of a Limited Data Set
To the extent System’s Use or Disclosure of PHI would be permissible under Section 4.4 of this Manual as a Limited Data Set, System may Use or Disclose such Limited Data Set to a recipient only if the recipient has agreed to a Data Use Agreement that meets the requirements set forth in this Section.
6.4(2) Data Use Agreement
A Data Use Agreement shall:
6.4(3) Monitoring Recipients of a Limited Data Set
If System learns that a recipient of a Limited Data Set has performed a material violation of its Data Use Agreement, System shall take reasonable steps to end the violation and mitigate the violation’s harmful effects in accordance with Section 8.4 of this Manual.
6.4(4) Documentation of Data Use Agreements
System shall retain any Data Use Agreement entered into with any person. Such documentation shall be retained in accordance with Section 9.2 of this Manual.
45 C.F.R. § 164.514(e)
67 Fed. Reg. at 53,234-38 (Aug. 14, 2002)