As of April 24, 2023, CMS requires that researchers:
- Use the new Research Identifiable File (RIF) request forms for all Data Use Agreement (DUA) actions.
- Have an approved Data Management Plan Self-Attestation Questionnaire (DMP SAQ) for a new DUA request or extensions of an existing DUA with physically shipped data.
If your DUA includes physically shipped data and your organization does not have an approved DMP SAQ, you are at risk of losing access to CMS physically shipped data indefinitely. Effective April 24, 2023:
- You will not be able to extend a DUA with physically shipped data without an approved DMP SAQ.
- If your DUA is not extended or closed by the expiration date, your DUA status will change to "expired." At this point, all DUAs for your organization will be locked and the only DUA action that will be permitted without an approved DMP SAQ is a DUA closure.
- If your DUA status is "expired" for 30 days, your organization will be in violation of the terms of the DUA. At this point, you and all other researchers associated with your organization will be required to:
- Close all DUAs, including DUAs for the Chronic Conditions Warehouse Virtual Research Data Center (CCW VRDC) and Limited Data Set (LDS) files and
- Destroy all physical CMS data files associated with these DUAs, including LDS files.
Researchers at organizations that have violated the terms of the DUA because the organization has not complied with the DMP SAQ requirement will be prohibited from requesting a research DUA with physically shipped CMS data indefinitely.
Please plan accordingly and allow a minimum of 6 weeks for the completion of the DMP SAQ and CMS review, audit, and approval.
To view your organization's current DUAs and their expiration dates, you can request the DUA Viewer role within CMS' Enterprise Privacy Policy Engine (EPPE). To request and use the role, please refer to the DUA Viewer Role training.
Researchers can begin using the new forms for RIF requests and establishing a DMP SAQ at any point before 4/24/23:
- New RIF request forms: The new forms are simpler and easier to complete and can be downloaded using the Request Forms Generator on the Research Data Assistance Center (ResDAC) website. We have created new job aids and optional submission checklists to facilitate the request process.
- New DMP SAQ form: The DMP SAQ is specific to the computing environment where the CMS data is stored and processed. The same DMP SAQ can be referenced for multiple research requests. Organizations will need to establish a DMP SAQ for their computing environment and link any existing DUAs. Researchers accessing data solely through the CCW VRDC will not need to complete a DMP SAQ.
Questions on CMS' new requirements for research DUAs can be directed to: resdac@umn.edu.