Limited Data Set (LDS) Files

LDS General Information :: LDS Policies :: Registration Instructions :: Training Materials:: Important EPPE Transition Information

LDS: General Information

The Centers for Medicare & Medicaid Services (CMS) makes Limited Data Set (LDS) files available to researchers as allowed by federal laws and regulations as well as CMS policy. LDS files contain beneficiary-level health information and are considered identifiable files, but they do not contain specific direct identifiers as defined in the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule. For information on available LDS files, please visit the CMS LDS website at /Research-Statistics-Data-and-Systems/Files-for-Order/LimitedDataSets/index

All disclosures of LDS files require a signed LDS Data Use Agreement (DUA) between CMS and the LDS requester. Requesters are also required to provide a research purpose as part of their request. The research purpose must relate to projects that could improve the U.S. healthcare delivery system. This includes projects related to improving the quality of life for CMS beneficiaries or improving the administration of CMS programs, including payment related projects and the creation of analytical reports. In addition, these research projects must contribute to generalizable knowledge. Please note, if you are requesting files for the sole purpose of commenting on CMS proposed or final rules, then your comments will fulfill the generalizable knowledge requirement.

LDS requests are submitted via a CMS tracking system called EPPE. Please refer to the EPPE registration instructions and training materials below to use EPPE to request a new LDS DUA or add LDS files to an existing LDS DUA. Questions about LDS files or the process for requesting LDS files can be sent to datauseagreement@cms.hhs.gov.

[Return to Top]

LDS: Policies

You must adhere to all LDS policies in the LDS DUA Terms and Conditions (PDF) at all times. These policies include, but are not limited to:

1. Cell Suppression: The CMS’ cell suppression policy stipulates that no data cell (e.g. admissions, discharges, patients, services, etc.) containing a value of 1 to 10 can be reported directly. Additional guidance about the CMS cell suppression policy can be found at the following link: https://www.resdac.org/articles/cms-cell-size-suppression-policy
2. Adding Custodians or Collaborators: It is important to note that additional Custodians or Collaborating organizations cannot be added to a DUA for the sole purpose of allowing them to view data that does not comply with the CMS cell suppression policy, including data on their own patients.  All organizations on the DUA must be involved with the actual research study as outlined in the Attachment A Study Protocol.
3. Research and Generalizable Knowledge: CMS is permitted to disclose LDS files for research purposes. Research is defined in HIPAA as “a systematic investigation, including research development, testing, and evaluation, designed to develop or contribute to generalizable knowledge.” (See 45 CFR 164.501) CMS interprets generalizable knowledge to mean that results of the research are made publicly available. Therefore, information must be included in the Attachment A Study Protocol that describes how the results of the research will be made publicly available. Please note if you are requesting files for the sole purpose of commenting on CMS proposed or final rules, then your comments will fulfill the generalizable knowledge requirement.
4. Data Storage: You must store your LDS data in the location you listed on your Attachment A Study Protocol.  CMS data cannot be moved unless you notify and receive approval from CMS. Please e-mail DataUseAgreement@cms.hhs.gov for additional information if you need to move LDS data.
5. Data Copies: You may not make duplicate copies of CMS data.
6. Data Shipping: CMS will only ship LDS data to a Requester or Custodian on the DUA, and only to an address that relates to the security requirements outlined in the Research Protocol. For all requests, a written description of how the address listed on the “Payment and Shipping” tab of the LDS worksheet meets required data security protections must be provided. Data security measures may include, but are not limited to, the following:
   • The custodian (or any other user) will not transfer CMS data to any equipment other than that provided by the custodian’s organization.
   • The new shipping address is physically secure at all times (e.g., doors and windows are locked).
   • All devices, including systems and hard drives associated with CMS data, are in a secure location when not in use (e.g., locked cabinet, safe, locked closet.).
   • The work session/laptop locks out after 15 minutes of inactivity.

[Return to Top]

LDS: Registration Instructions

LDS requesters are required to complete two trainings before accessing EPPE for the first time. Training materials are available as a PDF slide deck. Users will need to attest to completing the training when registering for EPPE roles.

[Return to Top] 

LDS: Training Materials

The following training modules provide instructions on performing specific actions in EPPE.

Who do I contact if I need help with EPPE?

If you need assistance with EPPE, please review the EPPE FAQs (PDF).  If you are unable to find the answer to your question, contact the EPPE Help Desk at 844-EPPE-DUA (844-377-3382) or EPPE@cms.hhs.gov

[Return to Top]

LDS: Important EPPE Transition Information

CMS has transitioned to a new LDS DUA request process where requesters submit and manage their DUAs directly through a new tracking system called EPPE. This has replaced the process where DUA requests were submitted via e-mail to datauseagreement@cms.hhs.gov. Requesters transitioning to EPPE should review the following guidance:

1. DUA Policies: Requesters are no longer required to complete a paper version of LDS DUA Form 0235L when submitting a DUA through EPPE. However, requesters will attest to and be expected to adhere to all policies listed in the LDS DUA Terms and Conditions. (PDF)
2. DUA Custodian: Custodians are required to complete and sign the DUA Addendum (PDF) form as part of the EPPE process. While the requester adds individuals to a DUA directly in EPPE, CMS still needs a signed copy of the DUA Addendum form for legal purposes.
3. Payment: You will receive an e-mail from EPPE with “PAYMENT REQUIRED” in the subject line when a request requiring payment has been approved. That e-mail will contain payment instructions. CMS will no longer issue the tracking number that used to appear in the subject line of the e-mails (e.g. LDS 20200303-1200P/DUA 12345).For additional guidance, please see the Payment page.
4. Attachment B: CMS no longer requires a paper Attachment B for LDS orders. The language is incorporated into the Attestation Statement within EPPE.
5. LDS Worksheet and Re-Use Worksheet: CMS is still requiring that you upload a completed LDS Worksheet (ZIP) in Excel Format for new files you need shipped to you, or the LDS Re-Use worksheet (ZIP) for Re-Use files.

[Return to Top]