CMS announced a new Data Management Plan Self-Attestation Questionnaire (DMP SAQ) requirement for all DUAs that will receive physically shipped research identifiable data from CMS. The DMP SAQ documents security and privacy controls implemented to protect CMS data in the environment in which the data will be stored.
The requirement goes into effect on 4/24/23. See the following announcement from CMS:
UCSF Approved Compute Environment
A CMS DMP SAQ has been completed and approved by CMS for UCSF's Research Analysis Environment (RAE). The approved SAQ can be used by all studies storing data in RAE. This DMP SAQ is managed by the CMS Data Reuse Program team in Academic Research System (ARS).
What you need to do!
Contact the CMS Data Reuse Program Manager, Victoria So ([email protected]), for any existing DUAs needing to comply with this new requirement. This will initiate a consultation with the PI around data storage and pairing the new DUA with the approved CMS DMP SAQ. We anticipate the pairing to take 4 to 6 weeks to complete.
- All CMS data must be stored in Research Analysis Environment (RAE) only to use the approved CMS DMP SAQ. We recommend all CMS data requests to be part of the CMS Data Reuse program. This allows other researchers at UCSF to reuse the CMS datasets purchased at a significantly reduced cost. Additional program services are listed on the CMS Data Reuse program website.
- Any CMS data stored outside of RAE is not recommended and will require a security assessment and CMS approval of a separate DMP SAQ. There will be costs associated with the creation of a new DMP SAQ and it will take a minimum of 6 weeks up to 4 months to complete. Contact the Research Security Program at [email protected] for a consultation and cost estimate