Innovator Research FAQs

An innovator is a researcher associated with a for-profit organization, or anyone conducting research with the intent to also create a product or tool to be sold. For example, an innovator could use CMS data to develop care management or predictive modeling tools.

Innovators can access CMS data only in the CCW Virtual Research Data Center (VRDC). The CCW VRDC is a virtual research environment for securely accessing and analyzing CMS data. All individual-level data are stored in the CCW VRDC and cannot be downloaded. Innovators access and perform their own analysis and manipulation of CMS data virtually by logging into the CCW VRDC from their independent workstations. Innovators have the ability to download aggregated reports and results to their own personal workstation. Innovators may only access data associated with the research portion of their request.

Any US-based entity is eligible to access CMS data under the innovator research program. Individuals accessing CMS data must be physically located in the US and must meet CMS citizenship/residency requirements.

Innovators will only be able to access data files that support their research study and are listed in their CMS Data Use Agreement (DUA). Innovators will only be permitted to download aggregate, statistical information since no personally identifiable information or protected health information may be taken out of the CCW VRDC. All requests to download aggregated data will be reviewed to confirm that CMS cell-size suppression policies are met.

Yes, the CMS data may only be used for the research purposes outlined within the study protocol that has been reviewed and approved by an IRB and the CMS Privacy Board. In addition, innovators will be required to provide information on the product, tool, or analyses that will be created using the CMS data. This information undergoes an extensive review to ensure that the data is not used to exploit beneficiaries or to create fraud or abuse in the CMS programs. Finally, the CMS data may not be used for marketing to beneficiaries.

Yes, each innovator is required to sign a Data Use Agreement (DUA) with CMS.

Section 13 of the DUA states that “the Requesting Organization understands that as a result of CMS’s determination or reasonable belief that unauthorized uses, reuses or disclosures have taken place, CMS may refuse to make future releases of CMS data to the Requesting Organization.”

Section 14 of the DUA states that there are “penalties under § 1106(a) of the Social Security Act [42 U.S.C. § 1306(a)], including possible imprisonment, may apply with respect to any disclosure of information in the data files(s) that is inconsistent with the terms of the Agreement. The Requesting Organization further acknowledges that criminal penalties under the Privacy Act [5 U.S.C. §552a(i)(3)] apply if it is determined that the Requesting Organization, or any individual employed or affiliated therewith, knowingly and willfully obtained the data file(s) under false pretenses. In addition, the Requesting Organization acknowledges criminal penalties under the 42 U.S.C. 290dd-2(f). The Requesting Organization also acknowledges that criminal penalties may be imposed under 18 U.S.C. § 641.”

There are two levels of review for innovator research requests.

First, the research protocol is approved under the existing research request process. In order to receive approval to access data for research purposes, all innovators must work with ResDAC to submit a research request packet to CMS. 

Second, there is an additional level of review that will focus on whether the product, tool or analyses could exploit beneficiaries or create the potential for fraud and/or abuse in CMS programs. 

Two CCW VRDC services, space and Databricks credit usage, have threshold limits. An annual space allocation of five (5) terabytes (TB) and 4,000 Databricks credits are allowed per DUA.

Innovators are approved to receive six (6) output reviews per DUA per week of up to two (2) gigabytes (GB). Multiple files may be downloaded but each file must be within the specified size limit.