Proposed CMS Data Access Changes May Hamper Health Services Research (2024)

For more than 60 years, health services researchers have utilized Medicare and Medicaid data not only to drive advancements in US health care efficiency, quality, and cost-effectiveness but also to shape the very foundation of health policy and program design. Therefore, when the Centers for Medicare & Medicaid Services (CMS) announced a new data access policy and fee structure on February 12, 2024, the AcademyHealth research community responded with swift concern.¹

CMS has proposed terminating all current and future physical data access and requiring data access only through the Chronic Conditions Warehouse Virtual Research Data Center (VRDC) due to growing data security concerns. All new data use agreement requests will require data access via the VRDC effective August 19, 2024; however, the date at which existing data use agreements receiving physical data must close or transition to the VRDC is not yet known, though CMS has stated that it will not begin before 2025. This approach to securing data has numerous issues, all of which may lead to serious public health ramifications. AcademyHealth strongly advocates for more time to gather user feedback, identify viable alternative solutions that protect data privacy and security, and ensure equitable and efficient access for legitimate research purposes.

In short, the proposed changes alter long-standing practices for providing data access to researchers and institutions, increase costs, exacerbate inequity, and discourage multidisciplinary work and innovative methods. While ensuring that data security is a priority commitment for all researchers, AcademyHealth members have described in meetings and communications with the organization the logistical challenges using the VRDC, including the limits on available coding languages and open-access code, as well as slow processing speeds within the VRDC environment. Indeed, researchers report that using the VRDC can be tedious and prone to system errors. The research community also expressed concerns about limiting access to the VRDC without significantly expanding its functionality and affordability.

The cost of VRDC access is prohibitive. As proposed, access to the VRDC would require payment of the following fees: (1) a seat access fee of $20 000 per year per user with a $13 000 annual renewal fee for SAS-only coding; (2) an annual project fee per data use agreement of $15 000; and (3) a space/usage cost fee of $1500 for every 1 terabyte block of space or 2000 Databricks credits. These fees, paired with the limits on sharing seats/screens between researchers, reduce the ability to provide seats for the multiple researchers typically engaged in a research project. In addition, the limits on space/usage and associated additional costs may inhibit researchers working with large amounts of data or data spanning multiple years.

The per-user fee is likely to result in restricted access to CMS data for students and research assistants. This could have serious detrimental effects on the training and development of future scholars. Training programs would have to limit the number of trainees able to use the VRDC and limit instructors’ ability to check their work within the VRDC environment.

The shift to VRDC-only access will exacerbate inequities, disproportionately affecting researchers from underresourced institutions and those who have already invested substantial resources in physical data capabilities. For instance, the long-term underfunding of historically Black colleges and universities has limited their ability to attain the distinction of being an R1 institution, thus limiting their ability to obtain the more generous external research grants needed for larger-scope projects. The additional fees would further existing financial barriers that limit historically Black colleges and universities from increasing their research capacity.

The financial and logistical barriers to accessing CMS data through the VRDC will also likely deter interdisciplinary collaborations, a hallmark of health services research and an essential tool for addressing complex health and system issues. Logistically and operationally, the instability and lag time associated with the VRDC will likely be exacerbated by increasing the user base without related investments in the technology. With analysis restricted to the VRDC, any such downtime in the VRDC halts the entire Medicaid and Medicare research community, leading to the loss of productive person-weeks or person-years of analysis for every day of technical malfunctions, which are reported as relatively common by researchers in the community.

The VRDC environment presents challenges for research innovation, primarily due to limited computing resources. These constraints significantly hamper the feasibility of using machine learning approaches, which require extensive computational power. Such limitations can impede the progress of health services research by restricting the scope of methodologies available to researchers, thus stifling analytical and methodological innovation.

The framework of existing grants or projects makes compliance with the policy changes impossible in many cases and unworkable in most. Research grants, including those from the National Institutes of Health, the Agency for Healthcare Research and Quality, the Patient-Centered Outcomes Research Institute, and philanthropic nonprofits, are funded in multiyear windows. With existing grants in progress, the aggressive timeline for compliance requires researchers to transition during a study. Research organizations also make notable investments in data they plan on reusing for multiple projects and budget the savings into grant applications. The new fee structure would require additional investment not provided in such grants.

Finally, and most importantly, the restriction on data access would hinder the development of essential evidence needed for health care improvements, transparency, and accountability. Vital research areas, including health equity, health care quality, hospital consolidation, and drug pricing, rely on comprehensive access to CMS data for rigorous and reproducible studies.

The research community is gratified by the extension of the comment period by CMS. In a letter to CMS, AcademyHealth suggested several additional actions to support solutions that effectively balance needed data security and researcher access.² AcademyHealth recommended immediately withdrawing the notice to allow time for meaningful dialogue with stakeholders, including researchers, academic institutions, data and security experts, and professional organizations.

In addition, CMS should ensure the VRDC environment meets the range of researchers’ needs and provides opportunities to perform timely, quality analysis while maximizing data security. Given the concerns about the current computing infrastructure and the substantial increase in users and computational power required with such a transition, CMS should ensure that the VRDC environment and infrastructure are expanded to meet these needs before transitioning users. To minimize disruption, a slower and phased implementation of any policy changes, accompanied by adequate financial and logistical support for researchers transitioning to the VRDC, is critical. Lastly, given the significant investments in data security and privacy by research institutions, we encourage CMS to reconsider the complete discontinuation of physical data extracts. A more nuanced approach, possibly involving enhanced security measures or selective access based on demonstrated compliance with data privacy standards, could preserve research integrity while ensuring data security. We believe that protecting patient data is critical, but it must be done in a manner that is both effective and minimizes negative externalities on research.

The proposed changes to the CMS research data request and access policies pose critical and unnecessary burdens to the research community and the broader goals of improving health care quality, efficiency, and equity in the US. It also is a dramatic and unnecessary step back in the work that CMS has done toward accessible data and the implementation of the Foundations for Evidence-Based Policymaking Act of 2018 (Evidence Act) and the FY2023-2026 Evidence-Building Plan released by the US Department of Health and Human Services.³ The research community is committed to engaging with CMS and other stakeholders to find balanced solutions that maintain equitable, affordable access to these critical data resources. Through collaborative efforts, we believe it is possible to address security concerns without unduly restricting the research essential for advancing public health and health care policy.

Published: May 31, 2024. doi:10.1001/jamahealthforum.2024.1284

Open Access: This is an open access article distributed under the terms of the CC-BY License. © 2024 Caplan J et al. JAMA Health Forum.

Corresponding Author: Josh Caplan, MA, MPP, Government Affairs, AcademyHealth, 1666 K St, Ste 1100, Washington, DC 20006 (josh.caplan@academyhealth.org).

Conflict of Interest Disclosures: All authors are employed by AcademyHealth, which advocates for its members who have a direct interest in the changes proposed in this Viewpoint. Dr Simpson reported being President and CEO of AcademyHealth at the time of writing this article.

Additional Contributions: We express our gratitude to Annaliese Johnson, MPP, AcademyHealth, and Isa Granados, MS, AcademyHealth, for their editorial contributions. No additional compensation was received by these individuals.

Disclaimer: JAMA Health Forum is an official journal of AcademyHealth. The opinions in this article should not be interpreted as the official policy of the journal.