Back to top

How can innovators and entrepreneurs use CMS data?

Innovators and entrepreneurs may now access CMS data as part of a research study to create products or tools that they intend to sell or to conduct research to create analyses related to their own business needs. For example, an innovator could use CMS data to develop care management or predictive modeling tools.

How will innovator researchers access CMS data?

Innovator researchers will be able to access CMS data only in the Virtual Research Data Center (VRDC). The VRDC is a virtual research environment for accessing and analyzing CMS data in a secure manner. The VRDC allows researchers to access and perform their own analysis and manipulation of CMS data virtually from their independent workstation. Researchers also have the ability to download aggregated reports and results to their own personal workstation. 

What types of entities are able to access CMS data under the innovator researcher policy?

Any entity is eligible to access CMS data under the innovator research policy if it submits the required materials and receives approval from CMS.

What data will innovator researchers be able to access in the Virtual Research Data Center (VRDC)?

Innovator researchers will be able to access approved research identifiable files in the VRDC. However, innovator researchers will only be permitted to download aggregate, statistical information since no personally identifiable information or protected health information may be taken out of the VRDC.

Are there any limitations on the use of these data?

Yes, the CMS data may only be used for the research purposes outlined within the researcher’s study protocol that has been reviewed and approved by an IRB and the CMS Privacy Board. In addition, innovator researchers will be required to provide information on the product, tool, or analyses that will be created using the Medicare data. This information undergoes an extensive review to ensure that the data is not used to exploit beneficiaries or to create fraud or abuse in the Medicare program. Finally, the CMS data may not be used for marketing purposes meaning the data may not be used for marketing to beneficiaries.

Are there penalties for misuse of these data?

Yes, each innovator researcher is required to sign a data use agreement (DUA) with CMS that contains penalties for misuse of the data.

What is the review process for innovator research requests?

There are two levels of review for innovator research requests.

First, the research protocol is approved under the existing research request process. In order to receive approval to access data for research purposes, all researchers must submit a research request packet to CMS. 

Second, there is an additional level of review that will focus on whether the product, tool or analyses could exploit beneficiaries or create the potential for fraud and/or abuse in CMS programs. To allow CMS to determine whether the proposed use of CMS data in a product, tool, or analyses is appropriate, innovator researchers are required to submit a request letter with details on:

  • The product, tool, or analyses that will be created using the CMS data
  • To whom the product or tool will be sold or how the analyses will be used
  • An estimate of the number and frequency of aggregated data the researcher wishes to remove from the VRDC.  

Can a researcher request to re-use physical data to conduct innovator research?

No, innovator research must be conducted in the VRDC.

What is the timeframe for approval of innovator research?

We anticipate the innovator research process will add an additional 6-8 weeks to the research request process. Review the CMS Research Identifiable Request Process & Timeline for more information.

What is the maximum size allowable for an approved output file leaving the CMS VRDC for innovators?

Innovators are approved to receive 3 output reviews per week of up to 300MB. Multiple files may be downloaded but each file must be within the specified size limit.

Once a data product has been approved for download, is it suitable for the public domain?

The output review process is intended as a safeguard within the VRDC environment but in no way should be considered a certification or approval from CMS. VRDC users are responsible for assuring their output complies with the requirements detailed in the CMS DUA and that they adhere to the DUA requirements when publishing their study results.