Use Agreement (DUA) Limited Data Set (LDS) Forms Research Identifiable Files (FIF) Forms (CMS-R-235)

CMS is permitted to disclose data files for approved research purposes in compliance with 45 45 CFR 164.512(i). Researchers requesting research identifiable files (RIF) must, as part of the request process, complete a research request packet that provides CMS with information pertaining to the research study, including describing how the research results/findings will be disseminated, as well as the data files being requested. Should CMS approve the research request, the data requestor enters into a Data Use Agreement (DUA). This data collection is necessary to ensure that disclosures of data for research purposes comply with federal laws and regulations as well as CMS policy. Researchers requesting RIF files also must complete a Data Management Plan Self-Attestation Questionnaire (DMP SAQ). A DMP SAQ is required each time a DUA is established. Both the DUA and the DMP SAQ forms are valid for one year from the date of approval and are renewable at expiration. If the environment described in a DMP SAQ is the same for multiple DUAs from a single organization, the same DMP SAQ can be used across the DUAs, provided it has not expired. The DMP SAQ is a technical, evidence basedevidence-based questionnaire that DUA users must complete as part of the data request packet. The DMP SAQ will enable CMS to evaluate researcher data systems to ensure that CMS data are adequately secured and appropriately protected, as per the Privacy Act and the HIPAA Privacy Rule. The DMP SAQ also allows CMS to measure compliance through the implementation of security and privacy controls as outlined in the National Institute of Standards and Technology (NIST) Special Publication 800-53 and the Centers for Medicare & Medicaid Services (CMS) Information Security and Acceptable Risk Safeguards (ARS). The second component of the DMP SAQ is to provide ongoing oversight. All organizations will be subject to routine audits of the environments used to store and process CMS data, as described in their organizational-level DMP SAQ.

The latest form for Use Agreement (DUA) Limited Data Set (LDS) Forms Research Identifiable Files (FIF) Forms (CMS-R-235) expires 2027-12-31 and can be found here.

RIF Request Packet

Federal Enterprise Architecture: Health - Health Care Services

Review document collections for all forms, instructions, and supporting documents - including paper/printable forms.