Federal Regulations Governing the Release of CMS Data

Purpose

This article describes the Federal Regulations that govern the release of CMS data for research.

Current Version Date:

05/23/2017

Overview

Data with personal identifiers are subject to the Privacy Act of 1974, HIPAA, and other Federal government rules and regulations. As such, CMS treats beneficiary information as confidential. CMS maintains a list of all the data that CMS collects called the “Systems of Records” (SOR). For each System of Record, CMS provides the primary purpose for the data collection and the reasons under which the data can be released.

The “Research” release provision allows external entities to request CMS data. Research is defined by the Privacy Act (45 CFR 164.501) as “…a systematic investigation, including research development, testing, and evaluation, designed to develop or contribute to generalizable knowledge.”

Regulations by File Type

Research Identifiable Files (RIF)

Research Identifiable Files contain beneficiary level protected health information (PHI). Requests for RIF data require a Data Use Agreement (DUA) and a CMS Privacy Board review. The CMS Privacy Board members review the request to ensure that the data are adequately protected, the need is justified, and the request meets CMS criteria for release, which outlines how the data can be used.

Limited Data Sets (LDS)

LDS files are defined by the Privacy Act (45 CFR 164.514 (e)(2)) as “…protected health information that excludes the following direct identifiers of the individual or of relatives, employers, or household members of the individual:…” The Privacy Act lists sixteen different personal identifiers that must be excluded from a limited data set, such as name, address, telephone and social security number. Requests for a limited data set for research purposes require an LDS DUA, but do not go through a CMS Privacy Board review.

Public Use Files (PUF)

A Public Use File (PUF), also known as a Non-Identifiable File, is a file that has been stripped of any personal identifying information. PUFs provide aggregate or summarized information. Because a PUF does not include protected health information, it can be requested and used without a Data Use Agreement (DUA).

For more information on the differences between RIF, LDS, and PUF files, see Differences between RIF, LDS, and PUF Data Files.

Save as PDF (print)

Article Information

Author:

Faith Asper, MHS, CIPP/G

Level:

Introduction

Topic:

Policy

Program:

Medicare, Medicaid

Disclaimer:

The process and materials mentioned as part of this KnowledgeBase article are current, as of the publication date on the article, to the best of our knowledge. The examples provided are correct in the aggregate but may not apply to every subgroup or circumstance that a researcher may wish to study. It is up to the researcher to conduct analysis and confirm that the patterns described in this KnowledgeBase article apply to his/her particular study. If your research findings appear to contradict the advice provided, please contact ResDAC at resdac@umn.edu.