Privacy

DUA - Limited Data Sets (LDS)

See our What's New page for important information regarding your Data Use Agreements (DUA).

Limited Data Sets (LDS) contain beneficiary level health information but exclude specific direct identifiers as outlined in the Health Insurance Portability and Accountability Act of 1996 (HIPAA). LDS are considered identifiable even without the specific direct identifiers. Since the information is considered identifiable, it also remains subject to the provisions of the Privacy Act of 1974. These data are identifiable because of the potential for identifying a beneficiary due to technology, particularly in linking and re-identifying data files.

All disclosures of the LDS require a signed LDS Data Use Agreement (DUA) between the Centers for Medicare & Medicaid Services (CMS) and the Requester to ensure that the data remains protected against unauthorized disclosure. This DUA ensures compliance with both the Privacy Act and HIPAA.

To qualify for LDS, data Requesters must show that their proposed use of the data meets the disclosure provisions for research purposes as defined in both the HIPAA and the Privacy Act. The research purpose must relate to projects that could ultimately improve the care provided to Medicare patients and policies that govern the care. This includes projects related to improving the quality of life for Medicare beneficiaries or improving the administration of the Medicare program, including payment related projects and the creation of analytical reports.

LDS Requests do not require approval from the Privacy Board.

Requesting CMS Limited Data Sets (LDS)

Step 1 - These instructions apply to requests for new, re-use, re-release and updates (adding more files) for Limited Data Set (LDS) DUAs.

Step 2 - Effective May 1, 2011, all new DUAs requesting reuse or re-release of LDS data will be charged a nominal administrative fee of $600.00.

Step 3 - only send one (1) request for one (1) DUA in each e-mail

Step 4 - complete the LDS DUA including Attachment A - Research Protocol

Step 5 - for new and updates only, complete the LDS Worksheet, 

Step 6 - for re-use and re-releases only, complete a cover letter and clearly state the DUA # from which the files were originally received

Step 7 - create an e-mail:

    a) non-Federally funded DUAs send to DataUseAgreement@cms.hhs.gov

    b) Federal contract/grant DUAs send to your Project Officer (PO) but do NOT cc DataUseAgreement@cms.hhs.gov

Step 8 - Effective June 1, 2012, the Subject line for all e-mails requesting LDS DUAs must be:

    a) new, re-use and re-release         LDS - Requester Organization Name

    b) updates                                     DUA ##### - LDS        (##### is the DUA #)

Step 9 - for Federal contract/grant DUAs only, the PO must send the e-mail to DataUseAgreement@cms.hhs.gov, and state their approval of the request.  Be sure to cc the individual who originated the request as well as the Requester of the DUA.

Step 10 - you will receive an e-mail from the CMS DUA team confirming the creation/update of your DUA.  The e-mail confirmation will contain how to make payment information where applicable.

Related Links