- 1 When do I need a CMS DUA?
- 2 What does "study specific" mean?
- 3 How long does it take for a DUA to be approved?
- 4 Who is responsible for CMS DUAs?
- 5 What kind of file description is the investigator required to include in their reuse request?
- 6 How do I fill out a CMS DUA?
- 7 If I am collaborating with other investigators from different institutions, where should the DUA originate?
- 8 What types of funding are there?
- 9 What are DUA Extensions and Closures?
- 10 Where should I store my project work?
- 11 Additional Specific Communications with ResDAC and CMS
When do I need a CMS DUA?
A new data use agreement (DUA) is required when researchers are requesting data for a new study. A "study" is defined as having a strong research design, which clearly states the objectives and the significance of the research being conducted and provides a credible, straightforward argument for the importance of the project. The study shall address the following areas: hypotheses/study issues, data limitations, analysis plan and analysis methods. The scope and subject matter of the study must assist CMS in monitoring, managing, and improving the Medicare and Medicaid programs and the services provided to beneficiaries.
What does "study specific" mean?
CMS ensures DUAs remain study specific:
1) All documents in the DUA request must have matching titles, including the IRB and evidence of funding.
2) Funding, especially federal funding, drives the need for a new use/reuse DUA.
3) Change in scope usually requires a reuse but in some cases, CMS may approved a modification to scope of work, especially where the corresponding Notice of Award and IRB titles are the same. Please see email below from ResDAC related to an inquiry about what do when a grant is renewed and the scope of work is expanded/changed.
How long does it take for a DUA to be approved?
The entire CMS DUA application process takes ~12-14+ weeks depending upon the files being requested and the complexity of the study. Generally, there are at least two (2) review cycles with ResDAC that takes ~2 weeks for each cycle. ResDAC then submits the final application to the CMS Privacy Board. The CMS Privacy Board meets once per month. Any request involving Part D (drug) data, requires an additional review with the CMS Part D Privacy Review Board.
Who is responsible for CMS DUAs?
The CMS "User" on all Dartmouth DUAs is Jill Mortali, who signs on behalf of the Trustees of Dartmouth College. This position must be held by someone who can sign on behalf of Dartmouth College.
The primary Data Custodian is Stephanie Tomlin. This signer is the person who access to the raw data and is responsible for all aspects of the data, including but not limited to the organization, maintenance, security, and storage in accordance with the DUA.
The secondary Custodian(s) includes the Principal Investigator (PI) and anyone else who is added via signature addendum to the DUA. Secondary custodians, include those who have access to and supervise others that have access to the raw data and legally agree to abide by the DUA.
Individuals with access to individual level data (defined as cell sizes less than 11) will need to sign a signature addendum unless they are directly supervised by someone who has already signed the Data Use Agreement or a signature addendum. If an individual will only have access to summary level data, they do not need to sign a signature addendum.
- A signed Addendum is only required for those individuals other than the DUA User and Custodian who will have direct, unsupervised access to the raw data.
- If the same individual is both User and Custodian on the DUA, ResDAC recommends including another individual on the DUA under a Signature Addendum so there will always be at least 2 people listed on the DUA to receive CMS communication of expiration notices, etc.
What kind of file description is the investigator required to include in their reuse request?
"CMS expects the investigator to include the list of the original (raw) data files that comprised the derivative files in section 2.2. Also, in order to track the derivative files, please list the derivative files by name in section 2.2. They can be listed at the top of 2.2 with a brief (1-2 sentence) description of the raw files used to create the derivative file(s) and the general contents. CMS does not need a variable list or record layout, just a brief explanation of the contents."
How do I fill out a CMS DUA?
If I am collaborating with other investigators from different institutions, where should the DUA originate?
If you are funded by an external entity (versus internal funding), the organization listed as the awardee must be the Requestor/User on the request. All documents therefore must be on the awardee institution’s letterhead and a representative from that institution must sign as the User on the DUA. Sub-contractors may not submit the request as Requestor/User, but may sign as the Custodian of the data.
What types of funding are there?
External funding reflects funding where there is a specific study title (and specific aims) and specific PI(s) identified.
Internal funding reflects funding where it can be used for general purposes and goes to a center as opposed to PI(s)
What are DUA Extensions and Closures?
CMS DUA's may only be approved for a period of one year. After one year, the DUA will expire unless the DUA Requestor either extends or closes the DUA. The DUA system will send the Requester a notification e-mail 60 days before their DUA expires. Additional information can be found at CMS DUA Extensions and Closures
Note: If a DUA for an organization expires, it is important to note that ALL open DUAs for that organization will be frozen. This means that no new DUAs or actions on existing DUAs (e.g., adding data, changing contacts, or extending) can proceed for any DUA held by that organization until the expired DUA is either extended or closed.
Where should I store my project work?
All DAC data used must be contained within a project folder on the DAC servers, titled with the specific DUA number associated with it. Analysis specific to your DUA/project, may not occur under other DUA/project folders in the absence of a specific reuse request. This includes any raw or derivative file(s) developed by other projects.
Additional Specific Communications with ResDAC and CMS
What if my study started out with private funding and now I have federal funding so I want to get more data, can I just amend my privately funded DUA?
The answer is no. CMS does not allow researchers to amend DUA's that were originally privately funded and now are federally funded. You will need to submit a reuse request or reuse new use if you are requesting more data and submit a full request packet for review at the CMS privacy board.
Is it OK to make an amendment request to add objectives or do I need to do a new DUA?
This depends on the type of changes that are being made and will be considered on a case by caseby basis. You will need to work with the DAC Project Administrator who will reach out to ResDAC with your original study CMS protocol or with your original study protocol objectives to determine if adding objectives to your study is feasible or not.
What protocol does one have to follow for the following situation; a researcher acquired data through private funds supported by an institution, now he receives federal funding, his topics did not change or i.e. the aims he originally submitted to CMS remain the same. Will he need to notify ResDAC and CMS that he received federal funding?
The answer is yes, you will need to submit a reuse request now that the study is federally funded. Youcan contact ResDAC with specifics about the project, but you will need to notify ResDAC and CMS and submit a reuse request.
My colleague wants to use my data for her study. Can I amend my DUA with her name and give her access to the data?
Each DUA it is study specific and so if your colleague is planning on conducting a new study using your data she will need a new DUA. She would need to submit a reuse request and have the CMS privacy board review and approve the study before she can use the data for her study.
A researcher with a federally funded DUA would like to allow another researcher to close down their internally funded DUA due to lack of funding and complete their remaining work under an existing federally funded DUA. The scope of work on the internally funded DUA is within the scope of work on the federally funded DUA. Does the federally funded DUA need to reuse the internally funded DUA in order to use with derivative datasets developed under the internally funded DUA?
If the federally funded project wants to add the data from the other DUA to their DUA, they would need to go through an amendment process to reuse the data.
Project is Federally Funded but the Federal funds don't cover the total cost of the data files and the researcher wants to use internal funds to cover the remaining amount. Is this allowed?
This is allowed, however, the DUA and all documents need to state that this is a federally funded study. Payment from the two different sources is allowed, but federal funds take priority over any other funding.
Project was originally Federally funded, but funding has ended and requestor would like to Amend/update the DUA to obtain new data and continue the project under internal funds. Is this allowed?
Researcher can use internal funds to obtain a new DUA through a reuse request, but the original federal project officer must supply a letter of continuing support. If the Federal Project Officer will not supply a letter stating support, then the reuse will not be possible and the DUA will need to be closed.
If a project is internally funded to start with and the researcher receives federal funding to obtain additional data, how should this be handled?
The user should obtain a new DUA for the Federally approved protocol. Data could be reused, but the money that is coming from the Federal Agency for this work would need to be tied to the project the Federal Agency approved.
Derivative files are created frequently throughout the life of a project, including during subsequent reuse requests, so these files may be modified with the expectation that they will be useful both for the currently covered DUA and the reuse that isn’t yet approved. How can this best be differentiated?
Derivative files should only be created for the purposes of the DUA which CMS approved. Please see 1a above for how to include the derivative files in the reuse request.
At which point is a derivative file from one DUA available (and no longer available) to a newly approved reuse. Can a reuse DUA work with a derivative file from the reused DUA (original DUA) that is modified in the reused DUA after CMS approves the reuse? For example, if my request for 45637 reused 12345 and I continue building out a cohort on DUA 12345 after 45637 is approved, is it ok for me to keep moving derivative data from 12345 to 45637 or do I need to request another amendment to cover this?
CMS DUAs are study specific. CMS expects organizations to keep separate folders for each approved DUA. In keeping with your example, the raw data and derivative files created from 12345 are available to be reused for DUA 45637 as of the date that CMS emails their approval. After the files have been copied over to the new DUA 45637, no further data (including derivative files) can be shared without first obtaining CMS approval.
If Dartmouth wishes to share any data (raw files, derivative files, revised derivative files) between DUAs after the initial DUA folder is set up, then Dartmouth would need to submit an amendment request to CMS. Dartmouth may transfer the files only after CMS grants approval.
What about when the project aims across multiple DUAs are all within the same similar scope and planned to help support the derivative datasets collectively?
The 'scope' of the project (DUA) is determined by what was presented in the Executive Summary and approved by the CMS Privacy Board. Each DUA stands alone and it does not matter if other projects (DUAs) at Dartmouth cover similar topics. Each project's raw or derivative files should remain separated. Data files (raw or derivative) can not be shared across projects without explicit permission from CMS.