Public Use File (PUF)

Key facts

Main health publisher

Centers for Medicare and Medicaid Services (CMS), on data.cms.gov

Access

Free download, no application or data use agreement

Privacy protection

Aggregation or de-identification plus small-cell suppression

CMS small-cell rule

Counts under 11, such as claims or beneficiaries, are suppressed

Typical lag

Roughly one to two years after the service year

What is a public use file?

A public use file (PUF) is the most open tier of government data. Anyone can download it without applying, signing a data use agreement or paying a fee. To make that possible, the agency strips direct identifiers and either aggregates the data into summary counts or alters individual records so no person can reasonably be identified.

In healthcare the term is most associated with the Centers for Medicare and Medicaid Services (CMS), which publishes public use files on Medicare providers, services, prescriptions, hospitals and spending. Other federal agencies use the same label, including the Agency for Healthcare Research and Quality for Medical Expenditure Panel Survey files and the National Center for Health Statistics for survey data.

How CMS data access tiers work

CMS releases data in three main tiers, with more detail requiring more oversight:

• Public use files: aggregated or de-identified, free and open to anyone.
• Limited data sets (LDS): record-level data with direct identifiers removed but some elements such as dates retained, available under a data use agreement and usually for a fee.
• Research identifiable files (RIF): record-level data with identifiers, released only for approved research under a data use agreement and privacy review.

Why public use files matter

Public use files are the backbone of open healthcare analytics. Because many Medicare PUFs are published at the level of individual providers identified by National Provider Identifier (NPI), analysts can rank physicians by procedure volume, compare prescribing patterns, benchmark hospital charges and map services by geography without buying proprietary data.

They also make analyses reproducible. Journalists, policy analysts and researchers can cite the same file and data year, and anyone can check the numbers.

Limitations of public use files

The privacy protections that make PUFs public also limit them:

• Small-count suppression: CMS suppresses counts under 11, so low-volume providers, rare procedures and small areas often disappear or show blanks.
• Lag: most files describe services from roughly one to two years before release.
• No patient-level linkage: aggregated files cannot follow individual patients across providers or over time.
• Program scope: Medicare PUFs cover Medicare only, and many cover only fee-for-service claims.