OMB control number
Use Agreement (DUA) Limited Data Set (LDS) Forms Research Identifiable Files (FIF) Forms (CMS-R-235)
OMB 0938-0734 · HHS/CMS.
OMB 0938-0734
CMS is permitted to disclose data files for approved research purposes in compliance with 45 45 CFR 164.512(i). Researchers requesting research identifiable files (RIF) must, as part of the request process, complete a research request packet that provides CMS with information pertaining to the research study, including describing how the research results/findings will be disseminated, as well as the data files being requested. Should CMS approve the research request, the data requestor enters into a Data Use Agreement (DUA). This data collection is necessary to ensure that disclosures of data for research purposes comply with federal laws and regulations as well as CMS policy. Researchers requesting RIF files also must complete a Data Management Plan Self-Attestation Questionnaire (DMP SAQ). A DMP SAQ is required each time a DUA is established. Both the DUA and the DMP SAQ forms are valid for one year from the date of approval and are renewable at expiration. If the environment described in a DMP SAQ is the same for multiple DUAs from a single organization, the same DMP SAQ can be used across the DUAs, provided it has not expired. The DMP SAQ is a technical, evidence basedevidence-based questionnaire that DUA users must complete as part of the data request packet. The DMP SAQ will enable CMS to evaluate researcher data systems to ensure that CMS data are adequately secured and appropriately protected, as per the Privacy Act and the HIPAA Privacy Rule. The DMP SAQ also allows CMS to measure compliance through the implementation of security and privacy controls as outlined in the National Institute of Standards and Technology (NIST) Special Publication 800-53 and the Centers for Medicare & Medicaid Services (CMS) Information Security and Acceptable Risk Safeguards (ARS). The second component of the DMP SAQ is to provide ongoing oversight. All organizations will be subject to routine audits of the environments used to store and process CMS data, as described in their organizational-level DMP SAQ.
The latest form for Use Agreement (DUA) Limited Data Set (LDS) Forms Research Identifiable Files (FIF) Forms (CMS-R-235) expires 2027-12-31 and is listed under ICR 202505-0938-012.
Latest Forms, Documents, and Supporting Material
Form CMS-R-235 RIF DUA Signature Addendum
Form CMS-R-235 Key Personnel Supplement
RIF Request PacketAll Historical Document Collections
OMB Details
RIF Request Packet
Federal Enterprise Architecture: Health - Health Care Services
| Form | Name | Electronic access | Type |
|---|---|---|---|
| Form CMS-R-235 | RIF Request Application | Fillable Fileable | Form and instruction |
| Form CMS-R-235 | RIF DUA Signature Addendum | Fillable Fileable | Form and instruction |
| Form CMS-R-235 | RIF Extenstion Request Form | Fillable Fileable | Form and instruction |
| Form CMS-R-235 | Amendment Request Form | Fillable Fileable | Form and instruction |
| Form CMS-R-235 | Key Personnel Supplement | Fillable Fileable | Form and instruction |
| Form CMS-R-235 | Collaborator Supplement | Fillable Fileable | Form and instruction |
| Form CMS-R-235 | Innovator Supplement | Fillable Fileable | Form and instruction |
| Form CMS-R-235 | State Agency Supplement | Fillable Fileable | Form and instruction |
Review document collections for all forms, instructions, and supporting documents - including paper/printable forms.