To protect health, guide programming, and facilitate public health research, state, Tribal, local, and territorial (STLT) health departments share data with a range of partners. Often, data sharing arrangements are memorialized by a written agreement. This factsheet provides an overview of the agreements most commonly used by STLT health departments to share data as well as some of the considerations that are addressed by these agreements.

What types of agreements are used to share public health data?

Health departments generally use three types of agreements to share data with partners: data use agreements (DUAs), which are also known as data sharing agreements (DSAs), memoranda of understanding (MOUs), and business associate agreements (BAAs). Each type of agreement is defined below.

  • Data Use Agreement

    A data use agreement (DUA) lays out the roles and responsibilities of the parties to the agreement and typically includes the following provisions:

    • An explanation of the relationship between the parties
    • A description of the purpose for which the data will be used
    • Definitions of the key terms used in the agreement
    • A recitation of the law that governs the parties’ use of the data
    • Identification of any policies, procedures and technical specifications that the parties must follow.

    Typically, public health departments use the “minimum necessary” standard in DUAs which means the parties share the minimum necessary protected health information (PHI) or personally identifiable information (PII) to achieve the goal of the project.1 The minimum necessary standard is a standard that is required under the Health Insurance Portability and Accountability Act of 1996 (HIPAA).2 This standard is often adopted by state, Tribal, local, and territorial (STLT) agencies even when HIPAA does not apply. Sometimes state law adopts a similar standard, but often state law is silent. 

    Example: California Health and Human Services Data Exchange Framework: Single Data Sharing Agreement

     

    1 45 C.F.R. 164.502(b) (2025).

    2 Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191, 100 Stat. 2548.

  • Memorandum of Understanding

    Health departments may use memorandas of understanding (MOUs) in cases where parties want to work together but do not want to create legal obligations that result in liability for non-compliance. An MOU is a formal but non-binding agreement between two or more parties that lays out a mutual understanding of the purpose of data sharing, parties’ roles and objectives, the processes that parties will follow, and the project goals. Typically, MOUs do not require a lengthy contract review process, making it easier and less time-consuming to execute an MOU than a data use agreement (DUA).

    Example: North Carolina Interdepartmental Memorandum of Understanding

  • Business Associate Agreement

    If the health department is defined as a covered entity3 under the Health Insurance Portability and Accountability Act of 1996 (HIPAA), staff may have to execute business associate agreements (BAAs) to share data with certain partners. Not all public health departments are covered entities for the purposes of HIPAA, so this is important to clarify before entering into any type of data sharing agreement. In addition, some health departments are HIPAA hybrid entities, meaning HIPAA only applies to the programs in the department that meet the definition of a HIPAA covered entity. Typically, business associates are consultants or contractors who conduct activities or provide services to a covered entity that involve access to protected health information (PHI). The Health and Human Services website provides extensive information about business associate agreements including sample language.4 Example: U.S. Health and Human Services Contract Language for Business Associate Agreements

    3 Under HIPAA covered entities are health care providers, health plans and healthcare clearinghouses. (See 45 C.F.R. § 160.103 (2025).

    4 Business Associate Contracts, U.S. Dep't of Health & Hum. Servs. (Jan. 25, 2013), https://www.hhs.gov/hipaa/for-professionals/covered-entities/sample-business-associate-agreement-provisions/index.html [https://perma.cc/934B-C2VV].

  • Conclusion

    A well-crafted agreement should describe the project’s goals, the relationship between the parties, the data to be shared, the relevant laws that apply, and the mechanisms that will ensure compliance if appropriate. The agreement provides the negotiating parties with clarity and confidence that there is mutual understanding of the terms agreed upon by the parties for sharing data.

    Finally, your organization likely has internal processes and procedures for data sharing, and possibly even an attorney who can assist you with navigating data sharing issues. It is always a good idea to familiarize yourself with your organization’s rules and consult with attorneys and other partners throughout the process.

    Additional Resources 

    Questions?

    For legal technical assistance on public health data sharing agreements reach out to Manel Kappagoda (manel.kappagoda@mitchellhamline.edu) or Tom Pryor (tom.pryor@mitchellhamline.edu) at the Public Health Law Center. This resource is part of a series of factsheets prepared by the Public Health Law Center.

     

    Logos of Council of State and Territorial Epidemiologists and Public Health Law Center

     

    This resource is part of a series of factsheets prepared by the Public Health Law Center in partnership with the Council of State and Territorial Epidemiologists for public health managers in State, Tribal, Local, and Territorial health departments.

    The development of this resource was supported by the Centers for Disease Control and Prevention of the U.S. Department of Health and Human Services (HHS) as part of a financial assistance award totaling $949,000 with 100 percent funded by CDC/HHS. The contents are those of the authors and do not necessarily represent the official views of, nor an endorsement, by CDC/HHS, or the U.S. Government.