Active-fee-for-service contractors now have additional time to submit a DUA and SPI if they do not currently have a DUA and SPI on file. HHSC will notify contractors of the due date in a forthcoming notice.

Providers that have not yet submitted the DUA and SPI will receive information on an upcoming webinar/Q&A session, as well as a document including frequently asked questions pertaining to the DUA and SPI.

  • Adult Foster Care (AFC)
  • Community Living Assistance and Support Services/Continued Family Services (CLASS/CFS)
  • Community Living Assistance and Support Services/Case Management Services (CLASS/CMA)
  • Community Living Assistance and Support Services/Direct Services Agency (CLASS/DSA)
  • Community Living Assistance and Support Services/Support Family Services (CLASS/SFS)
  • Consumer Directed Services-Community Living Assistance and Support Services (CDS-CLASS)
  • Consumer Directed Services-Deaf Blind with Multiple Disabilities (CDS-DBMD)
  • Consumer Directed Services-Home and Community Based Services (CDS-HCS)
  • Consumer Directed Services-Primary Home Care (CDS-PHC)
  • Consumer Directed Services-Texas Home Living (CDS-TxHmL)
  • Consumer Managed Personal Attendant Services (CMPAS)
  • Day Activity and Health Services (DAHS)
  • Deaf Blind with Multiple Disabilities (DBMD)
  • Emergency Response Services (ERS)
  • Home and Community Based Services (HCS)
  • Home Delivered Meals (HDM)
  • Hospice
  • Primary Home Care/Family Care/Community Attendant Services (PHC/FC/CAS)
  • Program for all Inclusive Care for the Elderly (PACE)
  • Residential Care (RC)
  • Service Responsibility Option-Primary Home Care/Family Care/Community Attendant Services (SRO-PHC/FC/CAS)
  • Special Services to Persons with Disabilities (SSPD)
  • Texas Home Living (TxHmL)
  • Transition Assistance Services (TAS)

If you do not have a DUA and Security and Privacy Initial Inquiry (SPI) on file, please submit the requested forms to the address below:

HHS Access and Eligibility Services
Contracted Community Services
Attn: DUA & SPI
Mail Code W-357
P.O. Box 149030
Austin, TX 78714-9030

Please note you are only required to submit one DUA and SPI per legal entity.

When completing the DUA:

  • Enter your legal entity name in both ("CONTRACTOR") fields on page 1.
  • HHS staff will provide Exhibit B, which will include all active contracts associated with your Tax Identification Number (TIN).
  • On page 11, please sign the 'By:' field and enter all requested information in the CONTRACTOR portion.
    • If you do not use a subcontractor, Attachment 1 is not required.
    • If you use a subcontractor, Attachment 1 must be completed.
      • Sign the 'By:' field and enter all requested information in the CONTRATOR portion and have your subcontractor sign and complete the SUBCONTRACTOR portion. If you use more than one subcontractor, additional Attachment 1s will need to be submitted.
  • Please note, original signatures are required.

The purpose of the DUA is to establish a clear and consistent process for safeguarding confidential information and for reporting and correcting any unauthorized use or disclosure of the confidential information. The DUA incorporates a variety of regulatory requirements under state and federal laws and is not limited to requirements for securing protected health information under the Health Insurance Portability and Accountability Act. It is meant to be broader and include protection for all types of non-public information that HHS's contractors access in the performance of their contractual obligations.

Under the terms of the DUA, contractors are required to identify Privacy and Security Officers to insure compliance with data protection and security. You should direct your questions to your designated officials. The federal Department of Health and Human Services offers resources and information online. The HHS SPI will enable HHS Information Security personnel to assess whether you have sufficient safeguards in place to protect HHS confidential information. Please be sure to review the instructions for completing the SPI online.

Please be advised that failure to implement all required protections within the applicable timelines may result in a vendor payment hold or termination.

If you are unsure whether you have a DUA and SPI on file, please contact HHSC via email at All other questions about this alert can also be sent to Please provide the legal entity name and contract number(s).