In February 2024, the Centers for Medicare & Medicaid Services (CMS) announced plans to change how researchers access Medicare and Medicaid data to better protect controlled unclassified information. The original proposal included moving most research studies using research identifiable files (RIFs) to the Chronic Conditions Warehouse (CCW) Virtual Research Data Center (VRDC) and increasing fees for physical data to cover cost increases. This announcement provides an update on the planned changes and information on new security requirements to increase privacy and security of physical data shipments.
CMS gathered feedback from the research community through a Request for Information and feedback opportunity to understand the impact of these changes. The agency received extremely valuable input from academic researchers, non-academic researchers, and state and federal agencies about the proposed policy and pricing changes.
Based on this feedback, CMS has decided to delay the requirement to transition all research studies into the CCW VRDC indefinitely. Instead, CMS is implementing updated security requirements to better protect patient information while still meeting researchers’ needs. Beginning August 11, 2026, the following changes will apply to applicable RIF requests, extensions, and amendments:
- Updated Data Management Plan Self-Attestation Questionnaire (DMP SAQ). CMS has updated the DMP SAQ to reflect the latest security standards, CMS Acceptable Risk Safeguards (ARS) 5.1. Beginning 8/11/26, new DMP SAQs and DMP SAQ recertifications will need to comply with these updated standards. The new DMP SAQ requirements and other guidance materials, including a description of changes from ARS 3.1 to 5.1, are available on the CMS website here.
- New Extension Form Requirement. CMS will be collecting information on researcher’s publicly disseminated findings each year to ensure that CMS data is being used for research that contributes to generalizable knowledge. Beginning 8/11/26, researchers must submit a RIF Data Use Agreement (DUA) Extension Request form with this information in order for CMS to approve a DUA extension request. The form is available on the ResDAC website here.
- New Media Disposition Requirement. CMS will be requiring physical media containing RIF data to be destroyed within 90 days of shipment. Beginning 8/11/26, the researchers must submit a certificate of disposition (COD) to CMS to close out each shipment. The new COD form with the option “I am destroying all physical media but leaving the DUA and all files open” is available on the ResDAC website here.
CMS believes that working together with the research community is essential for creating policies that balance protecting beneficiary data with providing researchers access to reliable information. The agency is using the nearly 400 responses received from researchers to improve and enhance the CCW VRDC environment. This includes developing new tools, better documentation for new users, self-service options to reduce paperwork, and exploring ways to give students and junior researchers better options for access to CMS data. CMS also heard concerns that sudden policy changes could disrupt ongoing research, so the agency commits to providing at least 6 months’ notice before implementing any policy changes and 12 months’ notice before implementing any pricing changes.