Data delivery for researchers

Data requests are evaluated based on:

• their scientific significance and societal value,
• the appropriateness of the method and strategy for identifying causal relationships,
• the internal time and personnel effort required, and
• the associated risks.

Data delivery is excluded if:

• the purpose is purely commercial,
• the request comes from the field of market research or the pharmaceutical industry,
• data privacy cannot be ensured,
• the data does not exist,
• the external project competes thematically with projects of the CSS Institute, and/or
• the data is not retrospective, meaning future (repeated) data requests would be necessary.

In the Swiss context, health insurers do not have access to the following data, among other things:

• Outpatient diagnoses,
• Undefined metrics such as the number of doctor visits,  
• Individual income,  
• Education and educational status,  
• Individual details about employment (e.g., employer, workplace, work hours, etc.),  
• Accident costs for employed individuals,  
• Family structure,  
• Nationality/migration status.

The data are particularly suitable for analyzing the individual behavior of various actors in the healthcare market. Due to the often long-term insurance coverage, changes over time can be effectively described.

Since there are other insurers besides CSS, the data are not suitable for overall market analyses, particularly for examining the switching behavior of insured individuals. Due to the absence of outpatient diagnoses, the data are also not suitable for analyzing disease burden or the costs of specific diseases. Similarly, comparing different treatment options in terms of costs is generally not possible.

The data are generally provided in an R data format (.rds, .rdata) and without further aggregation. The data are restricted to calendar years; dynamic, intra-annual time windows around individual events are not created. Data cleaning and preparation are the responsibility of the data requester and require experience in handling and analyzing very large datasets. Where necessary, data are omitted or aggregated to ensure the anonymity of individuals.

For projects where insured individuals provide written consent for data usage and release CSS from its duty of confidentiality, we recommend involving us early in the project planning process. We require a copy of the consent form from each insured individual, as well as a mandatory, unique identifier (name, first name, and date of birth are not sufficient). We reserve the right not to provide data if a unique identifier is not available. However, projects involving patient consent are generally not our main focus for external data delivery due to the typically small number of individuals and the relatively high effort required.

All individuals involved in a project are required to commit in writing to fully comply with the duty of confidentiality under Article 33 ATSG, as well as the provisions of the Data Protection Act and its regulations (in particular Articles 1, 2, and 3 DSV). Specifically, all individuals must:

• Use the data only for the project specified in the data request,  
• Inform the CSS Institute about the project results,  
• Prevent unauthorized persons from accessing facilities where CSS data can be viewed,  
• Not share the data with third parties,  
• Adhere to data protection regulations and, in particular, ensure that anonymized data cannot be traced back to specific individuals,  
• Render the data unreadable, destroy it, or return it to CSS upon request no later than three months after the project's conclusion, and  
• Allow the CSS Institute and the CSS Data Protection Officer to review the implemented data protection measures at any time (Article 9 DSG).  

If data from multiple insurers are used, the individuals involved in the project must also:

• Refrain from making comparisons between insurers.  

In the event of a breach of these commitments by one or more individuals involved in the project, the offending individuals must pay CSS a penalty of CHF 50,000 per incident. Claims for damages remain reserved. Payment of the penalty does not release any project participant from the obligation to comply with the data protection declaration.

No, we do not charge any fees for providing the data. However, due to our limited resources, we prioritize early-career researchers who typically face greater challenges in accessing other scientific funding opportunities. For pure data deliveries, we also decline co-authorship in publications resulting from the provided data.

Since the CSS Institute conducts its own scientific research with the data, we can usually deliver the data within a few weeks after approval. We therefore request that data only be requested when the necessary resources (personnel, IT infrastructure, etc.) are available to begin analyzing the data. Commitments for future data deliveries for research projects still in the planning phase are generally not provided, except in rare cases (e.g., applications for early-career funding programs from the SNSF).

In principle, it is possible to request data from multiple insurers. However, there is currently no standardized process, meaning each insurer handles the request differently. The information provided here cannot, therefore, be generalized. Since we have experience with scientific projects, we recommend contacting us first.