Legal binding agreement that the Centers for Medicare and Medicaid Services (CMS) requires to obtain identifiable data. It also delineates the confidentiality requirements of the Privacy Act of 1974 security safeguards and CMS’s data use policy and procedures.