Non-US based researchers are not permitted to access identifiable CMS data.
- Non-US based researchers are those who are physically located outside of the US and its territories. Non-US based researchers include individuals whose permanent address is in the US, but who are temporarily in another country.
- Non-US based researchers are not permitted to access identifiable CMS data through any means, including Virtual Private Network (VPN).
- Only CMS data that meets the CMS cell suppression policy specified in section of 9 of the CMS DUA and meets the Health Insurance Portability and Accountability Act (HIPAA) de-identification standards at 45 C.F.R. § 164.514(b) can be accessed by or shared with non-US based researchers.
Researchers whose permanent address is outside the US, but who are physically located in the US on a temporary basis may access identifiable CMS data at a US University/Non-profit Organization under the following conditions:
- The researcher is affiliated with a US University/Non-profit Organization (e.g., a visiting professor); and
- The US University/Non-profit Organization is the requestor and custodian of the data on the CMS data use agreement (DUA).
Researchers who are not US citizens or legal US Residents are not permitted to access federal systems; therefore, researchers who do not hold US citizenship or legal US Residency are not permitted to access data within the CMS Virtual Research Data Center (VRDC) regardless of where they currently reside. Legal US Residents include Lawful Permanent Residents and Temporary/Noncitizens. Users must be able to provide all of the necessary information, including a Social Security Number, to complete the Identity Proofing process required to gain VRDC access.
Examples of Common Scenarios:
- Access to data within the CMS Virtual Research Data Center (VRDC) Permitted: A professor from France is employed at a US University (USU) under a work visa and has obtained a Social Security Number and wishes to conduct research using Medicare or Medicaid data while at USU. USU would establish the DUA and sign as the requester and data custodian. The visiting professor, under the supervision of the USU data custodian, is allowed to access the data within the CMS VRDC while physically located in the US.
- Access to data within the CMS VRDC NOT Permitted: A professor from France travels to the US for a vacation to see a friend who is a professor at a USU, and they offer to help with a research project during their visit. The visiting professor is not allowed to access data within the CMS VRDC regardless of entering the US legally because they do not have a work visa nor obtained a Social Security Number.