PCOR Privacy and Security Research Scenario Initiative and Legal Analysis and Ethics Framework Development Welcome and Please Sign In »Please sign into the WebEx using your name and affiliation and/or record your name on the conference line after the prompt. »If you are not signing on to the WebEx, signing on anonymously, or did not record your name on the conference line, please Donaldson- to let us know you are on the phone.Donaldson- Participation »Please keep your own line muted throughout. »If you have a question, please raise your hand via the web and we will call upon you. »If you are not signed in to the web conference, please state your full name before speaking on the phone. »You may also questions or comments to Katherine Donaldson. 1

Patient Centered Outcomes Research (PCOR) Privacy and Security Research Scenario Initiative and Legal Analysis and Ethics Framework Development Stakeholder Work Group Meeting #11 April 20, 2016 NORC at the University of Chicago The George Washington University

Meeting Agenda Welcome Working through Research Data Use Scenarios »Mosaic Effect Use Case Analysis »Overview »Walking through Use Cases –Use Case 1: Combine Data for PCOR –Use Case 4: Identification and Re-Identification of PCOR Data Scenarios Under Revision Wrap-Up and Next Steps 3

Research Data Use Scenarios Prashila Dullabh, Daniella Meeker 4

New Scenarios Mosaic Effect » k+from+the+Mosaic+Effecthttp://confluence.siframework.org/display/PSRSI/Reindentification+Ris k+from+the+Mosaic+Effect 5

Overview of the Use Case Analysis Prashila Dullabh, Daniella Meeker 6

Overview of Progress and Structure 7 As a group, we have developed 16 scenarios to-date. They have sorted into specific thematic areas based on the type of process being performed. »E.g., Accessing Sensitive Behavioral Health Data for PCOR and Research Use Scenarios Related to Cumulative Re-identification Risks The thematic areas further cluster under various use cases, which reflect the technical aspects of the scenarios. »E.g., Consent Management and Use of Sensitive Data There are 16 scenarios grouped under 9 thematic areas, which fall under 5 use cases.

Organization of Research Data Use Scenarios under Use Cases 8 Use CaseThematic AreaScenario Use Case 1: Combine Data for PCOR Combining Independently Managed Data for PCOR Combining Clinical and Claims Data Combining Clinical Data with Birth Records Secondary Analysis of Administrative Data on Substance Use Treatment CER Use Case 2: Consent Management Research and Age-Related ConsentConsiderations Related to Consent and Transitions from Minor to Adult Research Data Use Scenarios on Special Populations and Protection Status Research Involving HIV-Positive Prisoners Consenting Individuals with Impaired Decision-Making Capacity Use Case 3: Release and Use of Protected Health Data for PCOR Accessing Sensitive Behavioral Health Data for PCOR Combining Mental Health Data with Physical Health Data Precision Medicine Consented Disclosures That Affect The Privacy of Family Members Testing and Disclosure of Genomic Data to a Minor Use of genetic bio-markers data for research Individual and Population-Level Research Related to Sub-Populations Privacy Concerns for American Indian/Alaska Native Individuals and/or Populations Use Case 4: Identification and Re-Identification of PCOR Data Research Use Scenarios Related to Cumulative Re-identification Risks Mosaic Effect: Precision Medicine Outside of Genomic Data Variations in Linkage Mechanisms/Availability of Unique Identifiers Creating A Multi-Institutional Unique Identifier for Research Use Case 5: Patient- Generated Health Data Patient-Generated Health Data Creating A Registry That Includes Patient Reported Outcomes Conducting Research on Patient Reported Outcomes within A Registry Use of Sensor Data

Use Case Analysis: Combine Data for PCOR Prashila Dullabh, Ioana Singureanu, Daniella Meeker 9

Use Case 1: Combine Data for PCOR, Thematic Areas and Scenarios 10

Use Case 1: Combine Data for PCOR, Preconditions Diagram 11

Use Case 1: Combine Data for PCOR, Workflow Diagram 12

Use Case Analysis: Identification and Re-Identification of PCOR Data Prashila Dullabh, Ioana Singureanu, Daniella Meeker 13

Use Case 4: Identification and Re-Identification of PCOR Data, Thematic Areas and Scenarios 14

Use Case 4: Identification and Re-Identification of PCOR Data, Preconditions Diagram 15

Use Case 4a Identification and Re-Identification of PCOR Data, Workflow Diagram: Using Identifying Traits 16

Use Case 4b Identification and Re-Identification of PCOR Data, Workflow Diagram: Using Hash Value 17

Legal Clarifications on constraints for privacy-preserving record linkage De-Identified data are not subject to HIPAA. »De-Identification under Safe-Harbor standards do not have utility for record linkage »De-Identification under Expert Determination may enable record linkage If an expert determination is obtained for hash approach, record linkage using hashed identifiers does not require a waiver of authorization or a BAA. »Expert determination must be based on the re-identification risk of the combined data, not merely the transferred data from each site separately. »Any subsequent re-identification requires HIPAA Waiver or consent. 18

Scenarios Under Revision Prashila Dullabh and Ioana Singureanu 19

Scenarios Under Comment and Revision Unintended Compromise of Participants Family Members’ Privacy, Identification of Health Risk » Collecting Clinical and Genetic Information to Study Serious Diseases, Risks to Patients/Family Members/Minors » Use of Genetic Biomarkers Data for Research » in+Researchhttp://confluence.siframework.org/display/PSRSI/Use+of+Genetic+Biomarkers+ in+Research 20

Wrap-up and Next Steps Prashila Dullabh 21

Review of Progress Summary of major decision points »Research data use scenarios, thematic areas, and use cases Materials will be posted on Confluence »You will receive links to relevant documents via »We will revise and post the updated versions for our next meeting Last meeting: Wednesday, April 27, 2016 at 1:00pm (ET) 22

Confluence Please access the Confluence site for this initiative using this link: » Research+Scenario+Initiative+and+Legal+Analysis+and+Ethics+Framework+Dev elopment+Homehttp://confluence.siframework.org/display/PSRSI/PCOR+Privacy+and+Security+ Research+Scenario+Initiative+and+Legal+Analysis+and+Ethics+Framework+Dev elopment+Home All notes and slides from previous meetings are available: » If you are interested in the Patient Choice project, you can access their project page via Confluence: » 23

Meeting Schedule Meetings will be held biweekly from 1-2pm ET on the following dates: 24 Meeting 1 (kickoff)Tuesday, December 1, 2015 Meeting 2Wednesday, December 16, 2015 Meeting 3Wednesday, January 6, 2016 Meeting 4Wednesday, January 20, 2016 Meeting 5Wednesday, February 3, 2016 Meeting 6Wednesday, February 17, 2016 Meeting 7Wednesday, March 2, 2016 Meeting 8Wednesday, March 16, 2016 Meeting 9Wednesday, March 30, 2016 Meeting 10Wednesday, April 6, 2016 Meeting 11Wednesday, April 20, 2016 Meeting 12Wednesday, April 27, 2016

Thank You