Reminder: DUA and VRDC access needs to be extended or renewed annually. Read more.
What is the requirement?
Effective August 11, 2026, CMS is implementing a new policy to require the destruction of physical media shipped to Research Identifiable File (RIF) requesters. This new policy mandates proper disposition of physical media for any data shipped after August 11, 2026.
Why is CMS implementing this requirement?
CMS is implementing this requirement to enhance oversight of physically disseminated data, eliminate duplicate copies of sensitive beneficiary information, and strengthen data security.
How can you comply with this requirement?
Once physical media containing RIF data has been shipped from CMS, the requesting organization will receive an email notification and have 90 calendar days to complete the following actions:
- Ensure that the data is received and loaded into a DMP SAQ approved computing environment.
- Destroy the physical media utilizing the options provided on the Certificate of Disposition (COD).
- Complete the COD form and ensure it is signed by the Requester, Data Custodian or additional contact listed on the DUA.
- Submit the COD to [email protected].
Please visit the Managing your project page for additional instructions on submitting the COD.
What happens if you miss the deadline?
Organizations that fail to submit the COD within 90 days of shipment are in violation of CMS policies. All data use agreements (DUAs) held by the requesting organization will be frozen, blocking all actions to request new DUAs, update existing DUAs, and extend existing DUAs. Organizations may also face the following consequences:
- CMS may require the requesting organization to submit a Corrective Action Plan (CAP). This plan must be approved by CMS before access is reinstated.
- Continued non-compliance can result with forced closure of DUAs, destruction of data, and being prohibited from future participation in CMS' research data disclosure program.