CMS-10522 EXECUTIVE SUMMARY FOR RESEARCH IDENTIFIABLE DATA CMS Vir

DEPARTMENT OF HEALTH AND HUMAN SERVICES
CENTERS FOR MEDICARE & MEDICAID SERVICES

Form Approved
OMB No. 0938-xxxx

EXECUTIVE SUMMARY FOR RESEARCH IDENTIFIABLE DATA
CMS Virtual Research Data Center (CMS VRDC) Request
For CMS Use only:
Privacy Board Approval Date

Part D Approval Date

DUA User name and title (see Item 16 of DUA)
Requesting Organization1 (see Item 1 of DUA)
Type of Organization
Academic

Non-Profit

State Government

Federal Government

For-Profit

Other

Study PI (if different from DUA User)
Study Title
Funding Source

EXECUTIVE SUMMARY
1. Study Overview Please describe your study objectives and aims.

2. How have you ensured that your data request includes the minimum amount of data necessary to achieve your research objectives?
2.1. Please describe how this cohort will meet minimum data necessary. (Include estimated cohort size.)

2.2. List the CMS data files and years being requested at this time and provide justification for how each will be used in the analysis.
If requesting reuse of data, include the DUA #5 to be reused. The list of files should match Item #5 of DUA. (Reuse Files must be
uploaded to VRDC by VRDC user. Please keep in mind the space limitation in the VRDC.)
2.2.1. List the Medicare (claims and enrollment) or Medicaid (claims and enrollment) being requested as this time and provide
justification for how each file will be used in the analysis. If requesting reuse of data, include the DUA # to be reused. The list of files
should match item #5 of DUA.

2.2.2. List the Part D event data (if using in study) being requested as this time and provide justification for how each file will be
used in the analysis. If requesting reuse of data, include the DUA # to be reused. The list of files should match item #5 of DUA.
(Reuse Files must be uploaded to VRDC by VRDC user. Please keep in mind the space limitation in the VRDC.)

1

Throughout this document, “organization” can be interpreted as the company, agency, or group or team within a company, depending on which makes more
sense in context with the research study for which CMS data files are being used.

CMS Virtual Research Data Center (CMS VRDC) Request (02/14)

1

2.2.3. List the Part D characteristics files (if using in study) being requested as this time and provide justification for how each file will
be used in the analysis. If requesting reuse of data, include the DUA # to be reused. The list of files should match item #5 of DUA.
(Reuse Files must be uploaded to VRDC by VRDC user. Please keep in mind the space limitation in the VRDC.)

2.2.4. List the Assessment data (if using in study) being requested as this time and provide justification for how each file will be used
in the analysis. If requesting reuse of data, include the DUA # to be reused. The list of files should match item #5 of DUA. (Reuse Files
must be uploaded to VRDC by VRDC user. Please keep in mind the space limitation in the VRDC.)

2.3. If this study will require further years of CMS data that are not yet available for request, please list those CMS data files and years
that will be required for the entire scope of your study (Note: Approval of data files for years that are not yet available will NOT be
granted at this time, the information included here will simply provide CMS with an overview of your study).

2.4. Please list any non-identifiable or non-CMS files you are planning to use in conjunction with the above files for your analysis. (e.g.
Provider of Services (POS) file, AMA Physician Master file, etc.)
Will the VRDC user be uploading these files to the VRDC?
YES
NO

3. You are requesting identifiable files. Why can’t Limited Data Set (LDS) files be used for this study?
Please check all that are applicable to this request.
I’m requesting data that are only available as identifiable data (Medicaid, Assessments, Medicare Part D event)
My research requires personal beneficiary identifiers (in order to link to other datasets or to contact Medicare beneficiaries)
My research requires beneficiary DOB, zip code, or physician identifiers.
Other (please explain):
4. Is it feasible to obtain individual level authorization from Medicare/Medicaid beneficiaries for your research? Explain.

5. If you intend on requesting the National Death Index segment of the Master Beneficiary Summary File, please complete the
NDI Supplement.
YES, I’ve included the NDI Supplement

NO, I’m not requesting the NDI

6. If this research project is funded by a commercial entity, the (primary) lead investigator attests that they will limit data sharing with the
funding entity to aggregated analytic results and will retain the right to independently prepare publications of the study results.
I attest
Signature of (Primary) Lead Investigator

CMS Virtual Research Data Center (CMS VRDC) Request (02/14)

Date

2

DISSEMINATION AND REPORTING OF FINDINGS
From the CMS DUA, “The User agrees that any use of CMS data in the creation of any document (manuscript, table, chart,
study, report, etc.) concerning the purpose specified in section 4 (regardless of whether the report or other writing expressly
refers to such purpose, to CMS, or to the files specified in section 5 or any data derived from such files) must adhere to CMS’
current cell size suppression policy. This policy stipulates that no cell (e.g. admittances, discharges, patients, services) 10 or less
may be displayed. Also, no use of percentages or other mathematical formulas may be used if they result in the display of a
cell 10 or less.“
I agree.
Please describe your plans for disseminating the findings from your analysis, including specific media through which you will report results.

CMS Virtual Research Data Center (CMS VRDC) Request (02/14)

3

PROJECT STAFF
This section specifically identifies the project staff, organization, and the role of individuals in this project. The requestor and
custodian should be named in this section at a minimum.
1. Name & Title of Requestor / User
Organization
Role in this Study
Will this individual have access to raw data, analytic files, or output with cell sizes less than 11?
NO.
YES, this individual will be directly supervised by DUA signatory, (Name:
YES, this individual has signed the DUA.

).

2. Name & Title of Custodian (This should be the user accessing the VRDC.)
Organization
Role in this Study
Will this individual have access to raw data, analytic files, or output with cell sizes less than 11?
NO.
YES, this individual will be directly supervised by DUA signatory, (Name:
YES, this individual has signed the DUA.

).

3. Name & Title
Organization
Role in this Study
Will this individual have access to raw data, analytic files, or output with cell sizes less than 11?
NO.
YES, this individual will be directly supervised by DUA signatory, (Name:
YES, this individual has signed the DUA or signature addendum.

).

4. Name & Title
Organization
Role in this Study
Will this individual have access to raw data, analytic files, or output with cell sizes less than 11?
NO.
YES, this individual will be directly supervised by DUA signatory, (Name:
YES, this individual has signed the DUA or signature addendum.

CMS Virtual Research Data Center (CMS VRDC) Request (02/14)

).

4

PROJECT STAFF (CONTINUED)
This section specifically identifies the project staff, organization, and the role of individuals in this project. The requestor and
custodian should be named in this section at a minimum.
5. Name & Title
Organization
Role in this Study
Will this individual have access to raw data, analytic files, or output with cell sizes less than 11?
NO.
YES, this individual will be directly supervised by DUA signatory, (Name:
YES, this individual has signed the DUA.

).

6. Name & Title
Organization
Role in this Study
Will this individual have access to raw data, analytic files, or output with cell sizes less than 11?
NO.
YES, this individual will be directly supervised by DUA signatory, (Name:
YES, this individual has signed the DUA.

).

7. Name & Title
Organization
Role in this Study
Will this individual have access to raw data, analytic files, or output with cell sizes less than 11?
NO.
YES, this individual will be directly supervised by DUA signatory, (Name:
YES, this individual has signed the DUA or signature addendum.

).

8. Name & Title
Organization
Role in this Study
Will this individual have access to raw data, analytic files, or output with cell sizes less than 11?
NO.
YES, this individual will be directly supervised by DUA signatory, (Name:
YES, this individual has signed the DUA or signature addendum.

CMS Virtual Research Data Center (CMS VRDC) Request (02/14)

).

5

DATA MANAGEMENT PLAN

Please reference the Data Management Plan Guidelines, Data Management Plan Review Checklist Evaluation Guide,
Collaborator Checklist, and/or the FAQ document for more information on completing this section. These materials are found
under the Executive Summary section of the New Study Requesting Data page of the website.
NOTE: A response is required (N/A or blank is unacceptable) for each item in the DMP except 3.5 (only applicable to PDE).

1. PHYSICAL POSSESSION AND STORAGE OF CMS DATA FILES
1.1. Who will have the main responsibility for organizing, storing, and archiving the data? Please provide name(s) and job title(s).

1.2. Describe how your organization maintains a current inventory of CMS data files.

1.3. Describe how your organization binds all members (i.e., organizations, individual staff) of research teams to specific privacy and
security rules in using CMS data files.

1.4. Provide details about whom and how your organization will notify CMS of any project staffing changes.

1.5. Describe your organization’s training programs that are used to educate staff on how to protect CMS data files.

1.6. Explain the infrastructure (facilities, hardware, software, other) that will be used to access the CMS VRDC.

1.7. Describe and identify policies and procedures regarding user access to the CMS VRDC.

1.8. Explain your organization’s system or process to track the status and roles of the research team.

1.9. Describe your organization’s physical and technical safeguards used to protect CMS data files (explain the safeguards used to protect
user ids/passwords, ensure users comply CMS VRDC rules of operation, only download statistical results, etc.).

* Note that CMS is specifically asking for references to written policies and procedures related to your organization’s administrative, technical and physical
safeguards. If policies and procedures have not been developed, please explain any ongoing activities your organization is taking to document policies and
procedures and make them available to staff. Organizations selected for DPSP reviews will be asked to provide copies of written policies and procedures.
Please note that an explanation of the process is not sufficient.
CMS Virtual Research Data Center (CMS VRDC) Request (02/14)

6

2. DATA SHARING, ELECTRONIC TRANSMISSION, DISTRIBUTION
2.1. Describe and identify your organization’s policies and procedures* regarding the sharing, transmission, and distribution of CMS data
files. Not applicable to the CMS VRDC.

2.2. If your organization employs a data tracking system, please describe.

2.3. Describe the policies and procedures your organization has developed for the physical removal, transport and transmission of CMS
data files (CMS VRDC user shall identify what will be done with any statistical files that are downloaded from the CMS VRDC).

2.4. Explain how your organization will tailor and restrict data access privileges based on an individual’s role on the research team (CMS
VRDC user shall include language to ensure they only request access to the minimum amount of data necessary for completion of
their project. Additionally, if a user has access for multiple projects, language shall be included to specify that the user will only access
the data files specific to each DUA).

2.5. Explain the use of technical safeguards for data access (including password protocols, log-on/log-off protocols, session time out
protocols, and encryption for data in motion and data at rest).

2.6. Are additional organizations involved in analyzing the data files provided by CMS?
Yes

No

If so, please indicate how these organizations’ analysts will access the data files:
VPN connection
Will travel to physical location of data files at requesting organization
Request that a copy of the data files be housed at second location
Other:
2.7. If an additional copy of the data will be housed in a separate location, please describe how the data will be transferred to this
location. (Also, please ensure you have included information on this organization’s database management under the appropriate
subsections of the database management plan.) This question is not applicable to this project as the data will be accessed within the
CMS VRDC.

CMS Virtual Research Data Center (CMS VRDC) Request (02/14)

7

3. DATA REPORTING AND PUBLICATION
3.1. Who will have the main responsibility for notifying CMS of any suspected incidents wherein the security and privacy of the CMS data
may have been compromised? Please describe and identify your organization’s policies and procedures* for responding to potential
breaches in the security and privacy of the CMS data.

3.2. Explain how your organization’s data management plans are reviewed and approved.

3.3. Explain whether and how your organization’s data management plans are subjected to periodic updates during the DUA period.

3.4. Please attest to the CMS cell suppression policy of not publishing or presenting tables with cell sizes less than 11.
(see Item 9 of the DUA)
I attest

The following item is for Part D requests only:
3.5. The researcher agrees that the pharmacy, provider, prescriber, or health plan will not be identified in this study.
I agree.

4. COMPLETION OF RESEARCH TASKS AND DATA DESTRUCTION
4.1. Describe your organization’s process to notify CMS when the project is complete and access is no longer needed.

4.2. Describe your organization’s policies and procedures for notifying CMS if a current CMS VRDC user is no longer working on the
project (particularly if a project involves multiple users).

4.3. Describe policies and procedures your organization uses to inform CMS of access changes when staff member’s participation in the
research project is terminated, voluntarily or involuntarily.

4.4. Describe your organization’s policies and procedures to ensure original data files are not used following the completion of the
project. This question is not applicable to this project as the data will be access within the CMS VRDC.

PRA Disclosure Statement: According to the Paperwork Reduction Act of 1995, no persons are required to respond to a collection of information unless it displays a
valid OMB control number. The valid OMB control number for this information collection is 0938-XXXX. The time required to complete this information collection is
estimated to average two hours per response, including the time to review instructions, search existing data resources, gather the data needed, and complete and
review the information collection. If you have comments concerning the accuracy of the time estimate(s) or suggestions for improving this form, please write to:
CMS, 7500 Security Boulevard, Attn: PRA Reports Clearance Officer, Mail Stop C4-26-05, Baltimore, Maryland 21244-1850.
CMS Virtual Research Data Center (CMS VRDC) Request (02/14)

8