In a major win for health services research, the Centers for Medicare & Medicaid Services (CMS) announced on Wednesday that it will indefinitely postpone a proposed change that would have significantly harmed access to federal health care data. Specifically, CMS is no longer requiring that researchers access federal claims data via the Chronic Conditions Warehouse (CCW) Virtual Research Data Center (VRDC), a change that would have impacted many ongoing projects in which researchers use so-called “physical” data files at their own institutions. The proposed change would have disrupted hundreds of existing projects — and future efforts — that use these data to inform policymaking in the Medicare and Medicaid programs.
This week’s announcement follows years of advocacy from AcademyHealth and the Medicaid research community about how the proposed data policy changes would impact researcher access to data critical for advancing evidence generation. The original February 2024 proposal sought to sunset access to physical data files through cost increases and requirements to transition data access to the VRDC by August of that year in the name of improved data security.
Concerned with the rapid timeline, staggering financial implications, and significant impacts on current and future projects, AcademyHealth quickly organized and engaged with CMS on how to both promote data security while not compromising research central to ongoing efforts to improve our public health care programs.
In collaboration with leaders from the Medicaid Data Learning Network (MDLN) and other researchers, AcademyHealth drafted a letter to CMS outlining the policy change’s imminent impacts and calling on CMS to recall the notice, engage with the research community, gradually phase in any changes, provide financial and technical support to support researchers, and continue allowing secure physical data use. AcademyHealth leadership and MDLN leaders separately contributed to JAMA Viewpoint describing how this change could compromise the continued learning critical for improving health across the Medicare and Medicaid programs. In addition to working with numerous academic stakeholders and coordinating efforts, we met extensively with CMS and bipartisan Congressional leadership to provide them with the evidence about what this proposal would mean for the future of Medicaid research. You can learn more about these meetings here.
The advocacy from the research community had immediate effect: in April 2024, CMS announced that no changes would go into effect until at least 2025 and in January 2025 opened a new Request for Information (RFI) to gain feedback from the research community on the impact of the proposed changes. AcademyHealth and the MDLN, in addition to nearly 400 other individuals, research groups, and advocates, submitted responses to the RFI, outlining technical, analytical, and financial concerns. You can read more about the MDLN’s work here, including a recently published reporting checklist designed to improve transparency and reproducibility in research using federal Medicaid claims data.
Wednesday’s announcement stands as a testament to the importance of collaboration between researchers and CMS in developing and implementing data policies, ensuring continued data security while also promoting the data access needed to generate actionable findings. CMS's announcement reflects an acknowledgement of these collective goals and the research community as a partner in the quest for continued learning.
Although CMS is not ending access to physical claims data, it will implement three key changes for data requests, extensions, and amendments involving Research Identifiable Files (RIFs) beginning August 11, 2026:
Data Management Plan Self-Attestation Questionnaires (DMP SAQs) and recertifications will need to comply with CMS’s latest security standards, Acceptable Risk Safeguards (ARS) 5.1. Additional details on the new DMP SAQ requirements and ARS, along with accompanying guidance, can be found here.
Researchers will be required to submit a new Data Use Agreement (DUA) Extension Request form with information on their publicly disseminated findings each year. The new form aims to ensure research using CMS data contributes to generalizable knowledge.
Researchers will be required to submit a new certificate of disposition (COD) to certify physical media containing RIF data is destroyed within 90 days of shipment. The new form includes an option to indicate that researchers will destroy all physical media but will leave the DUA and all files open.
Importantly, CMS has also committed to providing more advance notice before implementing any future changes: at least six or 12 months for any policy or pricing changes, respectively.
AcademyHealth is grateful for CMS leadership in working cooperatively with the researchers and end users of Medicaid data in order to find a way to satisfy our shared goals of robust research and evidence generation, improving health outcomes, and maintaining the security of patient data.