Pre-Award Grants and Contracts FAQs

1. Do I have the authority to sign a Confidentiality/Non-Disclosure Agreement (CDA/NDA)?

No. Confidentiality Agreements must be signed by a University Hospitals employee with Authorization Level 7 or above, which includes University Hospitals Cleveland Medical Center’s president. A UH employee that does not have this authorization level, including physicians, does not have the authority to sign on behalf of UH or to bind UH to a contract. It is important to remember that all CDAs/NDAs MUST be reviewed and approved by the Pre-Award office. In addition, the Pre-Award office will obtain the signature for you. Please do not contact UH Cleveland Medical Center’s president or any other authorized official to sign the CDA/NDA.

Please note that a physician/investigator can sign a contract as “Read and Acknowledged.” This does not make a physician/investigator a party to the agreement, it only confirms that he/she understands his/her obligations under the terms of the contract. It is important to note that an authorized UH official will still have to sign the contract even if a physician/investigator signs as “Read and Acknowledged.”

2. Who should sign my contract?

The Pre-Award office can you help you determine who should sign your research contract. Only authorized officials have the authority to sign contracts on behalf of UH. UH Policy GOV-7: Transaction Approval and Authorization determines the signing authority based upon the type of contract and the total amount of the contract. This policy establishes signature authority to protect UH employees from potential liability related to the contractual terms in research agreements.

Please note that a physician/investigator can sign a contract as “Read and Acknowledged.” This does not make a physician/investigator a party to the agreement, it only confirms that he/she understands his/her obligations under the terms of the contract. It is important to note that an authorized UH official will still have to sign the contract even if a physician/investigator signs as “Read and Acknowledged.”

3. Do I need a Data Use Agreement (DUA) to send data outside of UH?

Yes. If the transfer of data is not covered under another agreement, such as a Clinical Trial Agreement, then a Data Use Agreement is required. A DUA is an agreement between a covered entity and a recipient in which the covered entity discloses a Limited Data Set or a De-identified Data Set for purposes of research or any other lawful purpose specified in the contract. Data Use Agreements are required to restrict the use of the shared data, to safeguard the Protected Health Information (PHI) shared (if applicable), and to address issues such as ownership, privacy and publication rights related to the data. For data sets that are classified as Limited Data Sets, a DUA is required by law unless an exception applies. UH policy R-3 addresses Uses and Disclosures of PHI for Research.

There are two types of Data Use Agreements that UH uses to send data outside of the institution.

a) Data Use Agreement for a Limited Data Set (LDS). A Limited Data Set permits limited PHI to be sent to another institution. A total of 16 direct identifiers of a patient need to be removed prior to sending the data. Please refer to UH Policy PH-16: Limited Data Set: Permitted Purposes for Use/Disclosure for specific details regarding the identifiers that need to be removed. A template is available from the Pre-Award office to provide to the recipient of data when UH is the provider.

b) Data Use Agreement for De-identified Data. If you plan on sending de-identified data outside of UH, please ensure that the data is truly de-identified. Please refer to UH Policy PH-15: De-Identifying Protected Health Information (PHI) for additional information on de-identifying data. A template is available from the Pre-Award office to provide to the recipient of data when UH is the provider.

4. Do I need a Data Use Agreement (DUA) if I have a clinical trial agreement, collaboration agreement or subcontract for research purposes?

If you are participating in research that has been approved by the UH Institutional Review Board (IRB) and all subjects are required to sign informed consent forms, which include a valid HIPAA authorization, then you do not need a DUA in addition to your clinical trial agreement, collaboration agreement or subcontract; however, you must have one of these contracts in place if you are conducting research or sharing data with any person or entity outside of UH to ensure that the rights of UH and our patients are protected.

If you are participating in research that has been approved by the UH IRB but has been classified as Non-Human Subjects Research or a HIPAA waiver has been granted, then a DUA or other form of agreement is still required if data is being shared with any person or entity outside of UH.

5. Do I need a Data Use Agreement (DUA) if I am receiving data from an outside organization?

Yes. A DUA includes language that limits the use of the data and also includes ownership, privacy and publication rights related to the data. The organization sending you the data will likely request that their institution’s DUA be used. Please send their DUA to the Pre-Award office and your designated grants and contracts specialist will review the contract to ensure that UH can comply with the terms and conditions.