www.cms.gov Open in urlscan Pro
2a02:26f0:1700:384::28a  Public Scan

Form analysis
2 forms found in the DOM

GET /search/cms

<form region="cms_header_secondary" action="/search/cms" method="get" id="search-block-form" accept-charset="UTF-8">
  <div class="js-form-item form-item js-form-type-search form-item-keys js-form-item-keys form-no-label">
    <label for="edit-keys--2" class="ds-c-label visually-hidden">Search</label>
    <input title="Enter the terms you wish to search for." data-drupal-selector="edit-keys" type="search" id="edit-keys--2" name="keys" value="" size="15" maxlength="128" class="form-search ds-c-field" data-once="placeholder"
      placeholder="Search CMS.gov">
  </div>
  <div data-drupal-selector="edit-actions" class="form-actions js-form-wrapper form-wrapper" id="edit-actions">
    <div class="header-search-bar">
      <input data-drupal-selector="edit-submit" type="submit" id="edit-submit--2" value="Search" class="button js-form-submit form-submit ds-c-button ds-c-button--solid">
      <i class="fas fa-search" focusable="false"></i>
    </div>
  </div>
</form>

POST https://public.govdelivery.com/accounts/USCMS/subscribers/qualify

<form aria-label="Enter your email address for email updates" accept-charset="UTF-8" action="https://public.govdelivery.com/accounts/USCMS/subscribers/qualify" id="email-footer-form" method="post"
  data-drupal-form-fields="email-footer-input,email-submit">
  <div class="ds-u-display--flex" id="email-form">
    <div class="ds-u-display--flex ds-u-flex-direction--column flex-grow">
      <label for="email" class="ds-u-font-weight--bold ds-u-margin-bottom--1">Email</label>
      <input required="required" aria-label="Enter your email address:" name="email" type="text" placeholder="you@example.com" class="ds-c-field">
    </div>
    <div class="submit-button ds-u-margin-top--2">
      <label for="email-footer-submit" class="ds-u-visibility--screen-reader">Sign up for email updates</label>
      <button id="email-submit" class="ds-c-button ds-c-button--solid cms--external-button" name="email-footer-submit" type="submit" value="Sign up">Sign up</button>
    </div>
  </div>
</form>

Text Content

Skip to main content
U.S. Flag

An official website of the United States government Here’s how you know

Official websites use .gov
A .gov website belongs to an official government organization in the United
States.

Secure .gov websites use HTTPS
A lock ( lock ) or https:// means you’ve safely connected to the .gov website.
Share sensitive information only on official, secure websites.

Centers for Medicare & Medicaid Services


HEADER

 * About CMS
 * Newsroom

Search



CMS.GOV MAIN MENU

 * Medicare
 * Medicaid/CHIP
 * Medicare-Medicaid Coordination
 * Private Insurance
 * Innovation Center
 * Regulations & Guidance
 * Research, Statistics, Data & Systems
 * Outreach & Education
 * About CMS
 * Newsroom


BREADCRUMB

 * 
 * Research, Statistics, Data & Systems
 * Data Disclosures and Data Use Agreements (DUAs)


PAGES IN THIS SECTION


 * DATA DISCLOSURES AND DATA USE AGREEMENTS (DUAS)

 * * Enterprise Privacy Policy Engine (EPPE)
   * Identifiable Data Files
   * Limited Data Set (LDS) Files
   * Contractors
   * Contact Changes
   * Extensions and Closures
   * States
   * Disproportionate Share Data (DSH)
   * Forms
   * Payment


DATA DISCLOSURES AND DATA USE AGREEMENTS (DUAS)




The Centers for Medicare & Medicaid Services (CMS) makes data files available to
certain stakeholders as allowed by federal laws and regulations as well as CMS
policy. CMS enters into Data Use Agreements (DUAs) with most data requesters for
disclosures of protected health information (PHI) and/or personally identifiable
information (PII) to ensure that data requesters adhere to CMS privacy and
security requirements and data release policies. The Enterprise Privacy Policy
Engine (EPPE) is the system that tracks all disclosures of CMS data. For
additional information about EPPE, please visit the EPPE page located on the
navigation bar.  

CMS maintains three different categories of data files: identifiable data files,
limited data set files, and public use files. The privacy level of the data file
determines whether a DUA is needed as well as the request process and the level
of review required:

 1. Identifiable Data Files (IDFs) — IDFs contain PHI and/or PII and are only
    available to certain stakeholders. Requests for IDFs require a DUA with CMS.
 2. Limited Data Set (LDS) — LDS files also contain PHI, but they do not contain
    specific direct identifiers as defined in the Health Insurance Portability
    and Accountability Act (HIPAA) Privacy Rule. LDS files are only available
    for research use. Requests for LDS files require a DUA with CMS.
 3. Public Use Files (PUFs) — PUFs (also called non-identifiable data files) do
    not contain information that could be used to identify individuals. In
    general, PUFs contain aggregate level information. PUF requests do not
    require a DUA and are available on CMS websites (e.g., data.cms.gov).

Please use the navigation bar on the left to learn more about how to request
data or to update an existing DUA. For additional information on the differences
between these types of files, please visit the Research Data Assistance Center
(ResDAC) website at Differences between RIF, LDS, and PUF Data Files.

Please direct questions to DataUseAgreement@cms.hhs.gov.

--------------------------------------------------------------------------------


GENERAL GUIDELINES FOR REQUESTING DUAS

The below guidelines and restrictions should be followed when requesting a new
DUA or for any requests related to an existing DUA:

 * CMS does not accept personal e-mail addresses (@yahoo, @gmail, @outlook,
   etc.). The e-mail must be associated with an employer, organization, or
   university.
 * CMS does not accept P.O. Box or foreign addresses.  Data will only be shipped
   to addresses within the United States.
 * Organizations listed on a DUA should be at the company or university level as
   opposed to a department or component level.
 * If a DUA expires, it is important to note that ALL open DUAs for that
   organization will be frozen. This means that no actions (processing new DUAs,
   adding data, changing contacts, or extending existing DUAs) can proceed for
   any DUA held by your organization until the expired DUA is either extended or
   closed.


DOWNLOADS

 * Projects Conducted Under Research Data Use Agreements (DUAs) (ZIP)

Page Last Modified:
10/24/2022 11:45 AM
Help with File Formats and Plug-Ins


GET EMAIL UPDATES

Sign up to get the latest information about your choice of CMS topics. You can
decide how often to receive updates.

Email
Sign up for email updates Sign up


CMS & HHS WEBSITES CMS & HHS WEBSITES

 * Medicare.gov
 * Medicaid.gov
 * InsureKidsNow.gov
 * HealthCare.gov
 * HHS.gov
 * HHS.gov/Open


ABOUT CMS ABOUT CMS

 * About Us
 * Careers
 * Newsroom
 * Blog
 * Podcast


TOOLS TOOLS

 * Acronyms
 * Archive
 * Contacts
 * Glossary


HELPFUL LINKS HELPFUL LINKS

 * Web Policies
 * Privacy Policy
 * Plain Language
 * Privacy Settings
 * Nondiscrimination & Accessibility
 * Developer Information


USA GOVERNMENT SITES USA GOVERNMENT SITES

 * Freedom of Information Act
 * No Fear Act
 * Inspector General
 * USA.gov


CONNECT WITH CMS

 * Linkedin link
 * Youtube link
 * Facebook link
 * Twitter link
 * RSS Feed link

A federal government website managed and paid for by the U.S. Centers for
Medicare & Medicaid Services.

7500 Security Boulevard, Baltimore, MD 21244



Feedback