Section 590-120-4 - MHDO DATA USE AGREEMENT (MHDO DUA)1. All Data Recipients must sign a MHDO DUA. Only MHDO may use the MHDO DUA. The MHDO DUA is the document that details the data Recipient's commitments to data privacy and security, as well as the restrictions on the disclosure and use of the MHDO Data. The MHDO DUA shall provide adequate privacy and security measures that include appropriate accountability and breach notification requirements as required of business associates under HIPAA. Standard MHDO DUA's shall be published on the MHDO public website.2. Data Recipients must sign the MHDO DUA before the MHDO will release data at any level. MHDO DUA's shall include, but not be limited to the key provisions listed below: A. The Data Recipient will only use the MHDO released data for the approved purposes that were specified in the data request application.B. The Data Recipient will not release, furnish, disclose, publish or otherwise disseminate MHDO released data to any person unless authorized in writing by the MHDO.C. The MHDO shall retain all ownership rights to the data.D. The Data Recipient will reference the MHDO as the source of the data in all reports, publications, tables, graphs, or other products produced from the data.E. Unless authorized in writing by the MHDO, the Data Recipient will not use the MHDO Data, or link these data to other records or data bases, if the result allows for identifying individuals.F. MHDO Data may not be used to take legal, administrative, or other actions against individual subjects of data or to contact or assist others to contact any individual patients and/or physicians.G. Maine law controls the confidentiality, release, and use of MHDO Data.H. Data recipients shall be responsible for reporting any potential or actual data breaches to the MHDO. Data recipients shall indemnify MHDO for any damages resulting from a data recipient's data breach or other violation of law, and mitigate to the extent practicable, all harmful effects resulting from misuse of MHDO data.I. MHDO shall retain rights to track any person's use of or access to MHDO Data, and to deny access to data, when in the opinion of the MHDO Executive Director that is necessary to protect the privacy, security, or integrity of the data.J. At least twenty (20) business days prior to releasing any manuscript, report, or any other type of document or data compilation intended for dissemination or publication beyond the data recipient and that contains and/or uses MHDO Data, the Data Recipient agrees to provide the MHDO with a copy of such document. If the MHDO Data includes Cancer-Incidence Registry Data, the MHDO will forward a copy of the document to the Maine Cancer Registry. If the document contains/uses CancerIncidence Registry Data, that shall be sourced as follows: The Cancer-Incidence Registry Data was collected by the Maine Cancer Registry which participates in the National Program of Cancer Registries (NPCR) of the Centers for Disease Control and Prevention. If the MHDO determines that the manuscript, report, or any other type of document violates the MHDO DUA or does not provide adequate data suppression, the Data Recipient will be notified and must modify the report prior to its release.K. The MHDO DUA will specify the term of use, and identify the individual responsible for ensuring compliance with the DUA and specify the people who will have access to the data.L. MHDO DUA's shall make appropriate provision for the destruction of MHDO Data when use is complete, or when directed to by the MHDO Executive Director.M. Data Recipients shall immediately inform the MHDO of any legal process by which third parties try to obtain access to MHDO data held by entities authorized through an approved MHDO DUA and shall not turn over any data except as permitted by MHDO.N. MHDO may develop a memorandum of understanding and MHDO DUA with the Maine Center for Disease Control and Prevention (Maine CDC) for the ongoing release of Level I and Level II data to the Maine CDC for their purposes of conducting investigations as described in its MHDO application or evaluating the completeness or quality of data submitted to the Department of Health and Human Services disease surveillance programs.90-590 C.M.R. ch. 120, § 4