Opening paragraph and section 1
The Requestor's or User's organization name, entered in both places.
CMS-R-0235L
Data Use Agreement (DUA)- Limited Data Sets
- Agency
- CMS
- Revision
- 06/20
- Fillable fields
- 50
- Pages
- 6
- Official source
- CMS form page
- Checked
- October 20, 2026
Form CMS-R-0235L: Data Use Agreement (DUA) for CMS Limited Data Sets
Form CMS-R-0235L is the Data Use Agreement (DUA) for Limited Data Sets from the Centers for Medicare & Medicaid Services. It is an agreement between CMS and a requesting organization, which the form calls the User, for limited data set files derived from a CMS Privacy Act System of Records. The form says the agreement is needed so that the disclosure and use of those files comply with the Privacy Act of 1974 and the HIPAA Privacy Rule.
The agreement has 17 numbered sections. The User fills in its name, the study or project, the files and years requested, a retention date, a signature and a custodian for the files. Sections 16 and 17 are completed by CMS staff. Attachment A holds the Research Application Guidelines for the detailed research explanation.
The instructions say the agreement's language cannot be altered in any form. You can fill it out free in your browser on this page and download the result without an account.
What's on Form CMS-R-0235L
Section 3: Research purpose
The study or project name, the CMS contract number if applicable, and a brief summary of the purpose. A detailed explanation is attached to the agreement.
Section 4: Files and years
The limited data set files and years of data requested. The instructions ask for specific filenames and say a CMS representative can be contacted if they are unknown.
Section 6: Retention date
The date until which the User may keep the files, entered as the projected completion date of the study or project.
Sections 5 and 7 to 13: Terms
Terms on not identifying or contacting individuals, not linking records without written authorization, cell size suppression, security safeguards, processing fees, reporting unauthorized use, and penalties.
Sections 14 and 15: Signatures
The User's name and title, organization, address, phone, email, signature and date, then the same details and signature for the custodian.
How to fill out Form CMS-R-0235L
- 1
Read the instruction page
The instructions say the language in the agreement cannot be altered in any form, and list which sections the User completes.
- 2
Enter the organization name
Write the Requestor's or User's organization name in the first paragraph and in section 1.
- 3
Describe the research purpose
Complete section 3 and attach the detailed explanation, following the Research Application Guidelines in Attachment A.
- 4
List the files and the retention date
Name the files and years in section 4 and enter the projected completion date in section 6.
- 5
Sign and name the custodian
The User completes and signs section 14, and the custodian's details and signature go in section 15.
- 6
Leave sections 16 and 17 for CMS
The instructions say a CMS representative completes sections 16 and 17.
Why fill Form CMS-R-0235L on indox
You get the real form, filled in a browser tab, with nothing standing between you and the finished PDF.
- Fill the form right in your browser, no software to install
- Free to fill and free to download, with no account
- The official blank straight from the CMS, not a copy someone retyped
- Works on a phone, tablet or computer
Terms, fees and help
Help with the form
The instructions list the Division of Privacy Compliance Help Line at 410-786-3690 for questions about completing the agreement.
Where it goes
The form does not print a submission address. The CMS address in its Paperwork Reduction Act statement is for comments on the time estimate only.
Cell size suppression
Section 8a says no cell (for example admittances, discharges or patients) less than 11 may be displayed. Written products can be sent for CMS review, which the form says takes 4 to 6 weeks after receipt.
Retention and destruction
Section 6 says the User notifies CMS within 30 days if the purpose is completed before the retention date, then destroys the data and sends written certification of the destruction within 30 days.
Fees
Section 10 says the User reimburses CMS for all processing fees for each limited data set file. The form does not list amounts.
Time to complete
The form estimates an average of 30 minutes per response.
Related forms
CMS-R-0235A
Addendum to Data Use Agreement (DUA)
16 fields, 1 page
CMS-R-0235U
Data Use Agreement (DUA)- Update to Existing DUA
38 fields, 1 page
CMS-R-0235M
Medicaid Agency Data Use Agreement
45 fields, 6 pages
CMS-R-0235MA
Addendum to the Medicaid State Agency Data Use Agreement
26 fields, 1 page
CMS-R-0235MC
Compliance Plan for Accounting for Disclosures of Privacy Protected Data Released From a System of Records (SOR) Housed in a State-Located Server
10 fields, 1 page
Who uses Form CMS-R-0235L?
The agreement is between CMS and the organization requesting limited data set files.
Official sources and the blank
Do it all with indox
No tool matches that search.
Questions about Form CMS-R-0235L
Who signs Form CMS-R-0235L?
An individual authorized to act for the User signs section 14, the custodian signs section 15, and a CMS representative signs section 17.
Can the agreement's wording be changed?
No. The instructions say the language contained in the agreement cannot be altered in any form.
What is the cell size rule?
Section 8a says no cell less than 11 may be displayed, and no percentages or other formulas may be used if they result in displaying a cell less than 11.
How long can the data be kept?
Until the retention date in section 6. The form says that if the purpose is completed sooner, the User notifies CMS within 30 days, destroys the data and sends written certification of destruction within 30 days.
Can the files be shared with another organization?
Section 7 limits disclosure to what the agreement permits or the law requires, and section 8b says a Secondary User first enters into its own DUA with CMS.
What goes in the detailed research explanation?
Attachment A lists an introduction and purpose, project issues and methods, data management safeguards, key personnel, dissemination plans, and a statement on any proprietary information.
Who can I call with questions?
The instructions list the Division of Privacy Compliance Help Line at 410-786-3690.