The DAC is responsible for tracking and documenting all DUA compliance for any research study approved by CMS accessing CMS RIF data housed on the DAC Information System.
The estimated timeline for issuance of a new DUA from submission to the DAC to CMS approval for data use is 6 - 8 months.
Page Contents
DUA Requirements
CMS requires a new DUA when researchers are requesting new and reuse access to CMS data for a new study. A new study can be a result of a new primary award, a new sub-award, a new scope/aims with a study title different from an existing DUA from the same funding.
A "study" is defined as having a strong research design, which clearly states the objectives and the significance of the research being conducted and provides a credible, straightforward argument for the importance of the project. The study shall address the following areas: hypotheses/study issues, data limitations, analysis plan and analysis methods. The scope and subject matter of the study must assist CMS in monitoring, managing, and improving the Medicare and Medicaid programs and the services provided to beneficiaries.
DUA Roles
- Requester – The person authorized to legally bind their organization (known as the "Requesting Organization") to the terms specified in the DUA. This is a required role on the DUA. This is person is appointed by the organization that received the award for the primary funding for the research study and is required to sign the DUA.
- Data Custodian – An individual who will be responsible for ensuring that the environment in which the CMS data is stored complies with all applicable CMS data security requirements, including the establishment and maintenance of security arrangements to prevent unauthorized use.
- Additional Contact(s) - An Additional Contact is an individual that is involved in the research study. An individual listed as an additional contact will receive notifications about the DUA and will be able to perform certain DUA functions.
DUA Collaboration
A CMS DUA with more than one institution participating in the research study must provide a paragraph outlining the role of the institution that does not hold the Requester role.
DUA Processes
Requesting a new CMS DUA
The DAC provides support to researchers who wish to obtain a CMS DUA approval. This includes a review of the researcher drafted documentation, the preparation of all required supplemental documents, collection of additional required documents, submission of DUA document package to ResDAC, correspondence with ResDAC and the researcher through the review process, and follow up of receipt of signed approval from CMS .
Note: What you need to know before you submit your new DUA request
Information You Will Need to Submit
Note: You can find a list of the required supporting documents, their purposes, and a download option on the ResDAC Document Index page.
- Project Review Committee Approval of the Project Review Application and Analytic Memo
- RIF Application - Attachment A (Replaced Executive Summary effective April 2023) Note: This is a link to the blank template and this is a link to a template which includes examples to assist with completing the application.
- A through explanation of the scope of work for your project. It usually encompasses language specific to the research aims and objectives from a grant.
- Complete list of all CMS and non-CMS data to be accessed for the research study. You must include any non-CMS data which will be linked to CMS data. Each data set requires written justification.
Note: Please find links to helpful information for determining specific data files and years to request. Data Availability Table and the Data File Search page on the ResDAC website.
- Notice of Award (federal), Evidence of Funding (non-federal), or Dissertation Support Letter (student).
- Research Methods section of research study grant proposal (federal) or Study Protocol (non-federal).
- Project Specific IRB with HIPAA waiver approval letter (or proof of submission if not yet approved).
Note: The DUA and IRB titles must match exactly.
Note: If you are collaborating with an institution other than Dartmouth College on a DUA, a Project Specific IRB is required from both institution.
Requesting DUA Maintenance
The DAC is responsible for coordinating and communicating with the DUA Requestor/User, DUA Principal Investigator, DUA Federal Project Officer, and ResDAC to submit any requests for CMS review of a DUA. The DAC must ensure all DUA compliance requirements for any research study approved by CMS accessing CMS RIF data housed on the DAC Information Systems are met.
Types of Requests
- Amendment - Requires a change to the DUA (e.g. update to Scope of Work/Aims, adding new or reuse data, adding/removing a collaborating institution, etc.)
Note: An amendment can take several months to be approved depending on the changes being requested to be approved. - Additional Contact Change - Requires an updated Personnel a change to only the project staff section of the Executive Summary
Note: An additional custodian change takes only a few days to be approved. - Extension - Required every 12 months
Note: An extension takes only a few weeks to be approved.
Requesting a CMS DUA Closure
Data Destruction Information You Need to Know
- Requests are required at a minimum of 2 weeks prior to DUA expiration date.
- All datasets; SAS, CSV, excel, and STATA, will be destroyed prior to requesting closure of the DUA.
- Any data stored by the DAC in the project specific folder on the DAC servers and all code and programs will be destroyed.
- Any suppressed data in excel documents previously received through a data transfer may be maintained by the Principal Investigator.
- Should the principal investigator &/or programmer wish to maintain their code a data transfer “out” request is required to do so.