CDC ELC PROJECT Q CARGOS DUA MARICOPA COUNTY.PDF

2. Purpose and Background
1. General Terms
1.1 Parties to Agreement
This data use agreement (
) is made by and between the following parties:
Agreement
Data Provider: 
 having its primary offices at 
Maricopa County by and through the Maricopa County Department of Public Health
1645 E Roosevelt St, Phoenix, 
 ("
") 
Arizona, 85006, United States
Data Provider
Data Recipient: Centers for Disease Control and Prevention (
), having its primary offices at 1600 Clifton Road, Atlanta, GA 30333 (
 or 
"CDC"
"Data Recipient"
). CDC is a federal agency within the U.S. Department of Health and Human Services (
"CDC"
"HHS");
These parties will collectively be considered the 
 or individually, a 
.
"Parties"
"Party"
1.2. Period of Agreement, Amendment, and Termination
This Agreement will be effective as of the latest date signed below (
) by the Data Recipient and Data Provider. The term of this Agreement shall be 
"Effective Date"
 year(s), commencing from the date of the final signature. This Agreement may be renewed upon mutual written consent of the Parties.
5
Except as otherwise expressly provided herein, this Agreement may be amended only by the mutual written consent of the authorized representatives of each Party. 
Amendments to this Agreement must be made in writing and must be signed by all Parties to be effective.
Either Party may terminate this Agreement at any time by giving thirty (30) days' advance written notice addressed and delivered directly to the other Party. 
Termination will not alter the effect of any federal laws on data already provided to Data Recipient. Data Recipient agrees to use, maintain, store, protect, archive, 
and dispose of such data consistent with the terms of this Agreement. See Section 5.2
CDC DATA USE AGREEMENT 
Incoming Data

4. Agreement Administration
 
3. Covered Data
Data that are included within this Agreement will be referred to as 
 and will be described below. Covered Data will generally not include directly 
"Covered Data"
identifiable data, except where sharing of such data is allowed by applicable federal law and deemed necessary for the purposes stated above.
The Parties acknowledge that Covered Data are limited to those data specified below, which identifies the complete set of data items to which the Data Recipient will 
have access to under this Agreement
The Parties are permitted to transmit, access, receive, share and/or use any part of the Covered Data listed below as specified in the agreed purpose and uses, as set 
out herein:
Dataset Title
Dataset Description
From
To
PII
PHI
Maricopa County Department of 
Public Health CARGOS Data
The dataset includes line-level surveillance data on Neisseria gonorrhoeae 
infections and other emerging sexually transmitted infections with 
antimicrobial resistance (AR), collected by Maricopa County under the 
CARGOS project. Data elements (supporting attachment) include patient 
demographics, clinical presentation, specimen source, antimicrobial 
susceptibility testing (AST) results, treatment information, and follow-up 
outcomes. The dataset includes limited identifiers and protected health 
information, such as dates of clinical encounters and specimen collection, but 
does not include direct identifiers such as patient names, Social Security 
numbers, or street addresses. Note: Authorized Personnel will submit data as 
two separate files # a laboratory dataset and a clinical dataset through a 
secure access management system that meets the federal Advanced 
Encryption Standard (AES).
2024
2029
Yes
Yes
This Agreement establishes the terms and conditions under which the Data Provider will provide, and Data Recipient will receive and use, the data covered under 
this Agreement. This Agreement ensures adherence to guiding principles of accountability, privacy and confidentiality, stewardship, scientific practice, efficiency, 
and equity. Use and disclosure of the data must be consistent with this Agreement and with applicable law.
The Parties agree that the Data Recipient will use the data being shared for purpose(s) that include but are not limited to the following:
To strengthen coordination and expand capacity of Antimicrobial Resistance (AR) surveillance, preparedness, and response activities focused on STIs with current 
and emerging AR in the United States. AR in sexually transmitted infections (STIs) is a growing public health threat in the United States. Neisseria gonorrhoeae 
(GC), now designated an #Urgent Threat# pathogen, has developed resistance to nearly every antibiotic used for treatment. While surveillance is critical for 
monitoring and responding to AR, current systems often do not generate data quickly enough to support timely local response. The CARGOS project addresses this 
gap by expanding routine surveillance and building local capacity to conduct antimicrobial susceptibility testing (AST) directly within participating jurisdictions. 
Core activities include monitoring trends in GC antimicrobial susceptibility, with a focus on males with symptomatic urethral infections and males and females with 
pharyngeal GC. Optional activities will leverage the same infrastructure to expand surveillance to other anatomical sites, high-risk populations, and additional STIs 
with emerging AR, including Mycoplasma genitalium and urethral N. meningitidis infections. By enabling on-site AST and strengthening coordination among 
jurisdictions, regional laboratories, and CDC, CARGOS will improve the speed and quality of AR data, enhance response capacity, and provide actionable 
epidemiologic, clinical, and laboratory information. These efforts aim to guide targeted public health interventions, protect communities at highest risk, and inform 
strategies to slow the spread of AR in STIs.

5. Data Safeguards
 
 
5.1 Confidentiality, Security, and Transmission 
This section describes the confidentiality, security, and transfer protections afforded generally by CDC to data in CDC's custody and 
control. CDC agrees to the following:
a. Confidentiality:  CDC agrees to maintain the confidentiality of directly identifiable or potentially identifiable 
Covered Data to the fullest extent required by applicable federal law. When applicable, CDC will protect the 
confidentiality of the Covered Data consistent with the following federal laws: the Privacy Act of 1974; standards 
promulgated pursuant to the Health Insurance Portability and Accountability Act (HIPAA); and the Freedom of 
Information Act (FOIA). If more specific federal laws apply to the Covered Data, CDC will also comply with those 
laws.
CDC will assert relevant exemptions to disclosure available under federal law, most critically, when applicable, for: 
directly identifiable information; personal and/or private information of which the disclosure would constitute an 
The Parties acknowledge that, once transmitted to CDC, the Covered Data provided under this Agreement are in the custody and control of CDC and are subject to 
the laws applicable to CDC. Unless otherwise designated and agreed upon by Parties, the Data Recipient will act as the 
 of the Covered Data once 
"Data Custodian"
the data are transmitted. As Data Custodian, the Data Recipient is responsible for ensuring that the Covered Data are kept secured and that access to and use of the 
Covered Data is consistent with this Agreement and applicable law.
Where required by law, Data Recipient will ensure that the Authorized Users within Data Recipient's organization are deemed authorized to access the Covered Data 
and will receive appropriate security training and be aware of the terms of this Agreement.
The Data Recipient designates the following individual(s) as the primary Data Custodian(s) point of contact:
Unless otherwise designated and agreed upon by the Parties, the Data Provider agrees to transmit the Covered Data to the Recipient and agrees to designate a "Data 
"
Administrator
To the extent allowed by law, the Data Provider will ensure that the Covered Data may be transmitted to Data Recipient's organization consistent with the purposes 
set forth under this Agreement.
The Data Provider designates the following individual(s) as the primary Data Administrator(s):
Jonathan Bell, Data Administrator, 1645 E Roosevelt St, Phoenix, Arizona, 85006, United States, Jonathan.Bell@maricopa.gov
Margarita Rios, Data Administrator, 1645 E Roosevelt St, Phoenix, Arizona, 85006, United States, Margarita.Rios@maricopa.gov
Eboni T Galloway, Data Custodian, 1600 Clifton Rd NE, MS H24-4, Atlanta, Georgia, 30333, United States, jyo1@cdc.gov
Shacara Johnson, Data Custodian, 1600 Clifton Rd NE, MS H24-4, Atlanta, Georgia, 30333, United States, uzx1@cdc.gov

5.2 Data Maintenance, Storage, and Deletion 
CDC agrees to maintain, store, protect, archive, and/or dispose of Covered Data in accordance with applicable law and requirements. As a 
general matter, the disposition of records in CDC's custody and control is governed by the Federal Records Act and may only be 
accomplished in accordance with schedules for destruction as provided under law. In addition, the Parties agree that CDC must comply with 
circumstances where a litigation hold or other legal process applies to the Covered Data. Finally, the Data Provider agrees that, to comply 
c. Transmission   Parties may coordinate to ensure the secure transmission of information. However, Data Provider is 
ultimately responsible for undertaking any necessary data security protections until data is in CDC's custody and 
control. Such protections may include limiting the submission of identifiable, potentially identifiable, privileged, 
sensitive, or confidential information, or encrypting data prior to submission. Transmission of the Covered Data from 
Data Provider to CDC shall be done in accordance with acceptable practices for ensuring the protection, 
confidentiality, and integrity of the contents
b. Data Security  CDC shall establish appropriate administrative, technical, procedural, and physical safeguards in 
accordance with CDC security policies and the National Institute of Standards and Technology (NIST) Risk 
Management Framework, including formal System Security Authorization for the transmission systems involved. CDC 
will set permissions to access or edit data commensurate with the level of sensitivity of the data and in accordance with 
applicable federal law. In addition, consistent with CDC policies and procedures, CDC agrees to ensure that the 
individuals, in particular Authorized Users, within CDC receive appropriate data security training and are aware of the 
terms of this Agreement.
Data will be stored in accordance with applicable federal law and in compliance with CDC's security policies. Storage 
requirements may vary based on the nature of the data. Storage protections for directly identifiable data will include 
encryption or password protection, or other similar security feature to protect the data. As technology advances, 
appropriate data security provisions and access control methods for the storage location will be used.
If there is a data breach on or unauthorized disclosure of Covered Data from a CDC controlled platform, CDC will 
notify Data Provider of the incident as soon as practicable, without unreasonable delay. In the event of a suspected 
incident (loss, theft, compromise) affecting the security of data provided, the owner of the CDC controlled platform 
(CDC System Owner) will ensure that formal notice is provided to CDC's Cybersecurity Program Office (CSPO) via 
email at csirt@cdc.gov or telephone at 866-655-2245. CSPO personnel, with full assistance from the CDC System 
Owner, will then follow the established agency process for formal incident investigation, remediation, response, and 
communication as appropriate to all affected parties. Upon confirmation of an incident, CDC will ensure notification is 
made to impacted parties within required federal reporting timelines including, but not limited to, the Federal 
Information Security Modernization Act (FISMA) and Privacy Act.
invasion of privacy; trade secret and commercial or financial information that is private and confidential; or 
information exempted from release by federal statute. If required by law or if practicable, CDC agrees to notify the 
Data Provider before releasing Covered Data pursuant to a judicial, governmental, or other request under law, to allow 
Data Provider the opportunity to state any objection to the disclosure of the Covered Data. CDC will provide at least 
seven (7) days' notice unless the request legally requires a response sooner; in that case, CDC will use its best efforts to 
notify the Data Provider as soon as possible. In the event Covered Data is disclosed without notice to the Data 
Provider, CDC will notify the Data Provider as soon as possible after such disclosure is made.
Unless specified in this Agreement or otherwise legally required, CDC agrees not to use the Covered Data to link to 
other data for the purpose of determining identity or establishing contact with a named person or his/her family without 
prior written approval from the Data Provider.

7. Data Uses by CDC
 
CDC will use Covered Data only as consistent with CDC's authorities. To reduce duplicative data submission by Data Provider and maximize use of the Covered 
Data for appropriate public health purposes, uses of Covered Data include, but are not limited to:
7.6 Sharing the Covered Data and analyses thereof with official federal, state, local, Tribal, and territorial governmental health agencies, or 
entities collaborating with them in the execution of their public health role or their outbreak response responsibilities, consistent with 
applicable federal law and their own statutory authorities;
7.5 Analyzing and visualizing the Covered Data to improve the monitoring of routine and response-related testing and diagnostic-related 
activities, including testing and diagnostic safety and assessment of testing and diagnostic effectiveness;
7.4 Analyzing and visualizing the Covered Data to improve the monitoring of routine and response-related vaccination and vaccine-related 
activities, including vaccine safety and assessment of vaccine effectiveness;
7.3 Analyzing and visualizing the Covered Data to improve detecting, characterizing, monitoring, responding to, and recovering from cases 
and incidence of disease, conditions, and outbreaks
7.2 Analyzing and visualizing the Covered Data to inform and improve distribution of HHS, CDC, and other federal resources and other 
assets;
7.1 Analyzing and visualizing the Covered Data to provide an ongoing understanding of the nation's health at the federal and appropriate 
jurisdictional level, supporting local and regional public health practice at the jurisdictional level, and facilitating a seamless transition into 
response operations, when necessary;
6. Applicable Legal Authorities
 
Applicable federal, state, Tribal, local, and territorial laws and regulations may govern the collection, use, sharing, maintenance, and disclosure of Covered Data. The 
Parties recognize that Data Provider may be subject to its jurisdiction or other laws, which may limit its ability to share data. Before entering into this Agreement, 
Data Provider will inform CDC about any jurisdictional or other laws that restrict or limit the sharing of data. Throughout the duration of this Agreement, Data 
Provider will also notify CDC of any changes to these laws, if applicable.
The Parties further acknowledge that CDC, as a federal agency, is not subject to the application of state, Tribal, local, or territorial laws or regulations or the internal 
policies or procedures of the other party with respect to data in CDC's custody and control, except where consistent with federal law. While Covered Data is in the 
custody and control of CDC, the Parties agree that this Agreement does not act to change ownership of the Covered Data.
Further, as applicable to the Covered Data, CDC is a "public health authority" as defined at 45 C.F.R. #164.501 and as used in 45 C.F.R #164.512(b), Standards for 
Privacy of Individually Identifiable Health Information, promulgated under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"). CDC, as a 
public health authority, is authorized by 45 C.F.R. #164.512(b) to receive Protected Health Information ("PHI").
Finally, the Parties acknowledge that in the event of a public health emergency (#PHE#), or if an event is significantly likely to become a PHE, as provided in 42 U.S.
C. #247d, or in an event where CDC has undertaken an agency-led response effort consistent with CDC#s authorities, certain data already in the custody and control 
of CDC may be necessary to respond to the event. See Section 8 for further description of such potential uses.
with relevant records retention requirements and/or for the purposes of research integrity and verification, an archival copy of the Covered 
Data may be retained by CDC. Obligations under law to maintain and secure Covered Data will continue to apply to the data while in CDC's 
custody and control and will survive termination of this Agreement.

8. Reporting of Data Used in Publications and Presentations
8.3 Recurring Publications  The Parties acknowledge that in furtherance of CDC's public health authorities and mission, Covered Data 
may be used to develop regularly updated dashboards and other publicly available, electronically accessible materials. In circumstances 
where a recurring publication is regularly updated, such as an online dashboard, CDC will coordinate with the Data Provider prior to the 
first publication on determining any concerns related to privacy. CDC will not notify the Data Provider prior to each subsequent cycle of 
posting where no changes are anticipated.
8.2 Manuscripts, Reports, Presentations, and Other Single-Instance Publications:  CDC agrees to allow the Data Provider thirty (30) 
business days to review and provide comments for consideration on those manuscripts, reports, presentations, or single-instance 
publications. If publication needs to occur sooner than 30 days, CDC agrees to notify the Data Provider, who will expedite review consistent 
with the need to publish. The Data Provider has the option to waive this provision by providing a written waiver directly to CDC. 
Alternatively, if the Data Provider does not respond within five (5) business days to the CDC's request for coordination or review of draft 
publications or analyses, it will be considered as waiving the provision.
8.1 Publication: CDC agrees to coordinate with the Data Provider in advance of publishing data or analyses, consistent with applicable 
federal law and Office of Management and Budget (OMB) directives. CDC further agrees that, in such publications as noted below, it will 
not publish, or make publicly available, data which is directly identifiable or present minimal risk of re-identification in the context of its 
use, using standard industry practices to test for identifiability. Specifics as to the release of data elements and the level of specificity for 
release will be included in the relevant addendum.
CDC further agrees that it shall notify the Data Provider of the need to use the Covered Data beyond the specific uses listed above as soon as practicable.
The Parties also acknowledge that CDC, as a federal agency and as part of its mission, has a responsibility to make certain data available more broadly to the public. 
To that end, the Parties acknowledge that, where possible with the relevant Covered Data, CDC intends to make certain data publicly available, taking into 
consideration protecting privacy and confidentiality. CDC does not release directly identifiable information unless legally compelled to do so. CDC will not use data 
for commercial purposes. CDC will adhere to its Institutional Review Board policies and practices prior to use of data for research purposes, if applicable.
Finally, in a PHE, an event likely to become a PHE, or an event where CDC has undertaken an agency-led response effort consistent with CDC's authority, CDC may 
expand the use the Covered Data beyond the listed uses above, but only as consistent with HHS's and CDC's authorities under applicable federal law. If the nature of 
the event is such that expanded use is necessary, CDC will limit the use as much as possible to that necessary to address the response. CDC will protect individual 
privacy and confidential business or financial information to the fullest extent allowed by federal law. CDC further agrees that it will notify the Data Provider of the 
need to use the Covered Data beyond the uses listed above as soon as practicable and will work collaboratively with the Data Provider throughout the response to 
ensure coordination where possible and appropriate.
7.9 Publishing findings and conclusions related to their analyses of the Covered Data provided in coordination with Data Provider as 
described in Section 8.
7.8 Enabling public health and outbreak response officials, and other appropriate authorized users, to query the Covered Data within CDC or 
CDC-designated secure data platforms as may be necessary to carry out critical public health functions; and
7.7 Developing analytic methods using the Covered Data to identify immediate public health events or concerns at the federal, state, local, 
Tribal, and territorial level that warrant further public health investigation or immediate public health intervention actions;

9. Additional Terms and Conditions
 
9.2 Assignment
9.1 Entire Agreement 
Except where a funding award (e.g., grant, cooperative agreement, contract) is associated with the collection or generation of the Covered 
Data, this Agreement constitutes the entire agreement and understanding between the Parties and supersedes all prior oral or written 
agreements and understandings between them with respect to the Covered Data.
For funding awards, the Parties agree that the terms of this Agreement must be read as consistent with the terms of that award. In the event 
that a specific funding award for Covered Data requires more granular or more frequent data or has more specific details about the data, the 
terms of the award should prevail. The parties agree that, if a funding award for Covered Data requires data less granular than agreed to in 
this Agreement, the Data Provider will still provide the more granular data as specified in this Agreement.
8.9 Disclaimers  Except as provided herein, the Data Provider makes no representations with respect to data quality or fitness of the 
Covered Data for a particular purpose. However, the Data Provider agrees to maintain, consistent with its record retention schedule and 
jurisdictional law, documentation related to its collection or generation of the Covered Data and its transmission to CDC that may document 
steps taken to address data quality and completeness. Interpretations, conclusions, and opinions that CDC reaches as a result of analyses of 
the data are the CDC's interpretations, conclusions, and opinions, and do not constitute the findings, policies, or recommendations of the 
Data Provider. As appropriate or required, CDC will add disclaimers on publications where data provided under this Agreement are used.
 
8.8 Provider-Specific Requirements
Sub-section 9.9 CONFLICT OF INTEREST is added: Provider has given notice of Arizona Revised Statues # 38-511; however, CDC is 
governed by federal law and this state statute is not applicable.
8.7 Intellectual Property  Intellectual property rights on material arising from the use of the Covered Data will be determined by applicable 
federal law. Per mutual agreement between the Parties and where the Data Provider may retain any rights in resultant materials, the Data 
Provider grants full permission and a royalty-free, non-exclusive, irrevocable license to HHS and CDC to use, reproduce, publish, distribute, 
and exhibit materials arising from this Agreement for educational, training, and other purposes consistent with HHS's and CDC's mission. 
This license applies only to the material arising from the Covered Data and does not impact the Data Provider's ability to use data remaining 
in its custody and control.
8.6 Representation  To the extent permitted by applicable federal law, CDC agrees to assume full responsibility for its analysis and 
interpretation of the data in publications, and, where not otherwise publicly available, will provide a copy of the CDC report, publication, or 
presentation to the Data Provider.
8.5 Attribution  Where appropriate or required, CDC will factually acknowledge the Data Provider in any paper, publication, or 
presentation as the source of the Covered Data.
8.4 Publication in a PHE or similar event:  The Parties acknowledge that a PHE or similar event as set out in the "Data Uses by CDC" 
section above, may require the rapid publication of meaningful, real-time information. In that circumstance, CDC will provide the Data 
Provider as much notice as possible, as specified in (a) and (b) above, which may be less than 30 days.

10. Signatories
The undersigned individuals represent that they have competent authority on behalf of their respective agencies to enter into the obligations set out in this 
Agreement. Signature indicates that an understanding of the terms of this Agreement and an agreement to comply with its terms, to the extent allowed by law.
Printed Name: Kate Brophy McGee 
DATA PROVIDER REPRESENTATIVE 
Signature:
 
9.8 Notices
All notices or any other communication provided for herein shall be provided to the identified Data Administrator or Custodian: by 
registered or certified mail, return receipt requested; by receipted hand delivery; by courier or other similar and reliable carrier; or by email.
 
9.7 Funding
This Agreement is not an obligation or a commitment of funds, or a basis for the transfer of funds, and does not create an obligation or 
commitment to transfer data but rather is a statement of understanding between the parties concerning the sharing and use of Covered Data. 
Expenditures by each party are subject to its budgetary processes and to the availability of funds and resources pursuant to applicable laws, 
regulations, and policies.
9.6 Public Document 
This Agreement may be made publicly available.
9.5 Disagreements 
Disagreements between the Parties arising under or relating to this Agreement will be resolved by consultation between the Parties and 
referral of the dispute to appropriate management officials of the Parties whenever possible
9.4 Use of Electronic Signatures and Electronic Records 
The Parties may elect to establish processes for the management of and to facilitate compliance with this Agreement. This may include the 
development of procedural information, notices, and any other documents, which may be electronically developed or transmitted, arising 
from or pertaining to this Agreement.
The Parties permit mutually acceptable electronic signatures, to the extent permitted and consistent with applicable laws.
9.3 Mutual Representations 
Each Party to this Agreement represents to the other Party that, at all times during the term and at such other times as may be indicated, it 
shall comply with, and as applicable, shall require its directors, officers, employees, contractors, and others over whom it may exert legal 
control that have access to Covered Data to comply with its duties and obligations pursuant to applicable law and this Agreement, including 
but not limited to duties and obligations which survive the termination of this Agreement.
No party may assign or transfer any or all of its rights or obligations under this Agreement or any part of it, nor any benefit or interest in or 
under it, to any third party without the prior written consent of all Parties, which shall not be unreasonably withheld.
SIGN

Printed Name: Jami Leichliter Cain 
Title: DSTDP Research Science Officer 
Organization: NCHHSTP - NATIONAL CENTER FOR HIV, VIRAL HEPATITIS, STD, AND TB PREVENTION 
Date:
DATA RECIPIENT REPRESENTATIVE 
Signature:
Title: Board of Supervisors Chair 
Organization: Maricopa County by and through the Maricopa County Department of Public Health 
Date:
JAMI 
LEICHLITER 
CAIN -S
Digitally signed by JAMI 
LEICHLITER CAIN -S 
Date: 2026.04.08 
11:21:44 -06'00'

uzx1_0900f3eb825dfc91_OGC DHA 4-6-26.docx - Comments attached 
Maricopa County DOH - CDC DUA_Final_12172025.docx - Final DUA 
uzx1_0900f3eb825dfc91_OGC Comments_DHA 12-1-25.docx - Please find OGC comments attached. 
Maricopa County DOH - CDC DUA_Final.docx - Final DUA for OGC's review 
Maricopa County DOH DUA REVIEWED 10.08.2025.docx - External reviewer comments 
CARGOS Surveillance Program Data Elements.docx - CARGOS Data Elements 
Maricopa County DOH DUA.docx - Updated DUA 
APPENDIX A: LIST OF SUPPORTING DOCUMENTS