CMS Non-US Based Researcher Policy

Purpose

To describe the CMS policy that prohibits non-US based researchers from accessing identifiable CMS data (RIF and LDS) and provide examples of common scenarios.

Current Version Date:
11/08/2021
Save as PDF (print)

Non-US based researchers are not permitted to access identifiable CMS data.

  • Non-US based researchers are those who are physically located outside of the US and its territories. Non-US based researchers include individuals whose permanent address is in the US, but who are temporarily in another country.
  • Non-US based researchers are not permitted to access identifiable CMS data through any means, including Virtual Private Network (VPN).
  • Only CMS data that meets the CMS cell suppression policy specified in section of 9 of the CMS DUA and meets the Health Insurance Portability and Accountability Act (HIPAA) de-identification standards at 45 C.F.R. § 164.514(b) can be accessed by or shared with non-US based researchers.

Researchers whose permanent address is outside the US, but who are physically located in the US on a temporary basis may access identifiable CMS data at a US University/Non-profit Organization under the following conditions:

  • The researcher is affiliated with a US University/Non-profit Organization (e.g., a visiting professor); and
  • The US University/Non-profit Organization is the requestor and custodian of the data on the CMS data use agreement (DUA).

Researchers who are not US citizens or legal US Residents are not permitted to access federal systems; therefore, researchers who do not hold US citizenship or legal US Residency are not permitted to access data within the CMS Virtual Research Data Center (VRDC) regardless of where they currently reside.

Examples of Common Scenarios:

  • Access to Identifiable CMS Data Permitted: A professor from France is visiting US University (USU) and wishes to conduct research using Medicare or Medicaid data while at USU. USU would establish the DUA and sign as the requester and data custodian. The visiting professor, under the supervision of the USU data custodian, would only access the data while physically in the US.
  • Access to Identifiable CMS Data NOT Permitted: A USU researcher is a visiting professor at a Swiss University. The researcher wants to continue the research while in Switzerland. The researcher is not allowed to VPN in to USU and access the non-aggregated data. However, while out of the US the researcher could access aggregate results that meet the CMS cell suppression policy.
Save as PDF (print)

Article Information

Author:
Lori Siedelman, MPH
Level:
Introduction
Topic:
Policy
Program:
Medicare, Medicaid
Disclaimer:
The process and materials mentioned as part of this KnowledgeBase article are current, as of the publication date on the article, to the best of our knowledge. The examples provided are correct in the aggregate but may not apply to every subgroup or circumstance that a researcher may wish to study. It is up to the researcher to conduct analysis and confirm that the patterns described in this KnowledgeBase article apply to his/her particular study. If your research findings appear to contradict the advice provided, please contact ResDAC at resdac@umn.edu.