Data Management Planning for JHU SOM IRB Approval

Slides:

Advertisements

Similar presentations

Driving Factors Security Risk Mgt Controls Compliance.

Advertisements

Data Security Protocol

A Guide to Compliant Data Management

Financial Services Workshop Margaret Umphrey ECU Information Security Officer March 12, IT Security, East Carolina University.

Increasing public concern about loss of privacy Broad availability of information stored and exchanged in electronic format Concerns about genetic information.

The Health Insurance Portability and Accountability Act of 1996– charged the Department of Health and Human Services (DHHS) with creating health information.

HIPAA and Professionalism In an age of electronic mediums.

Common Errors to avoid in IRB- 03 (VA) Applications.

David Cloutier Director, Research Center Management and Development Budgeting for Industry Sponsored Clinical Trials.

1 CLOUD AND SaaS-BASED PLATFORMS: ENSURING DATA PRIVACY May, 2011.

SCRUB: Secure Computing Research for Users’ Benefit David Wagner 1.

Personal Data Protection and Security Measures Justin Law IT Services - Information Security Team 18, 20 & 25 March 2015.

HIPAA Data Security PCF Data Security Update May 1 st, 2015.

REDCap Overview Institute for Clinical and Translational Science Neil Nuehring Jesteny Pascual Daniel Hingtgen

Security and Confidentiality Practices - Houston Dept. of Health and Human Services Jerald Harms, MPH, CART and Jeff Meyer, MD, MPH HIV/AIDS Surveillance.

2012 VA IRB Administrators Meeting Stephania H. Griffin, JD, RHIA, CIPP/G VHA Privacy Officer Director, Information Access and Privacy Privacy Officer.

 background and intro  client deployment  system Architecture and server deployment  behind the scenes  data protection and security  multi-server.

SECURITY: Personal Health Information Protection Act, 2004 this 5 min. course covers: changing landscape of electronic health records security threats.

Mobility Without Vulnerability: Secure and Enable Your Mobile Users, Apps, and Devices David Clapp – Intuitive.

REDCap Overview Institute for Clinical and Translational Science Heath Davis Fred McClurg Brian Finley.

Data Security and Research 101 Completing Required Forms Kimberly Summers, PharmD Assistant Chief for Clinical Research South Texas Veterans Health Care.

Clinical Registries Needs and Solutions Dr. Peter Greene, CMIO Diana Gumas, IT Director 1.

Consent2Share Linking Cohort Discovery to Consent David R Nelson MD Assistant Vice President for Research Professor of Medicine Director, Clinical and.

ESCCO Data Security Training David Dixon September 2014.

Progress report of the ESID online registry Bodo Grimbacher, MD Head of ESID patient registries

PROJECT in a box PMO for under £1,000 “World Class with a global community of users” Project Manager Today April 2014.

Security Testing Case Study 360logica Software Testing Services.

Discussion Peggy Beeley, MD 2/11/14 Mitigating Medical Malpractice Risks Through Documentation.

ACADEMIC RESEARCH SYSTEMS November 11, UCSF MyResearch 101 Powered by Presented by

 background and intro  client deployment  system Architecture and server deployment  behind the scenes  data protection and security  multi-server.

Biomedical Informatics Program Douglas S. Bell, MD, PhD Leader, Biomedical Informatics Program Access to UCLA Clinical Data for Research.

September 12, 2004 Simplifying the Administration of HIPAA Security Angel Hoffman, RN, MSN Director, Corporate Compliance University of Pittsburgh Medical.

Empowering people-centric IT Unified device management Access and information protection Desktop Virtualization Hybrid Identity.

REDCap Overview Institute for Clinical and Translational Science Fred McClurg Neil Nuehring.

1 Role of the Privacy Officer on the IRB Stephania H. Griffin, RHIA, CIPP/G VHA Privacy Officer.

HIPAA: Breach Notification By: Office of University Counsel For: Jefferson IRB Continuing Education September 2014.

One Drive for Business: More Than a File Share Erica Toelle

 All lines are muted during presentation.  Lines are un-muted during Q&A ◦ If not asking question, please mute your line  *6 to mute your phone  *7.

Privacy and Security Considerations in Research and Clinical Trials February 28, 2013 Joanna K. Napp, J.D., M.P.H. Chief Privacy Officer and Compliance.

Productivity Architect Meet Chris Bortlik Author, Blogger, Speaker.

NOTE: To change the image on this slide, select the picture and delete it. Then click the Pictures icon in the placeholder to insert your own image. REDCap:

February 3, 2009 Bridging Academic and Medical Cultures Academic Research Systems and HIPAA William K. Barnett Anurag Shankar.

REDCap External Modules

OnCore Current Status and Implementation Project Plan

MUSC i2b2 Jean Craig, Biomedical Informatics

Top Compliance Topics.

Background Post-transplant outcomes in adult Fontan patients remain poorly defined. Available studies limited to sub-groups within published registry data.

DATA SECURITY FOR MEDICAL RESEARCH

Stephanie Oppenheimer, MS SUCCESS Center Erica Ellington, CRA, CHRC

Hybrid Cloud Solutions at IHG

Research and Reporting

Stony Brook University The Process for Joining TIES

9/4/2018 6:45 PM Secure your Office 365 environment with best practices recommended for political campaigns Ethan Chumley Campaign Technology Advisor Civic.

BUILDING A PRIVACY AND SECURITY PROGRAM FOR YOUR NON-PROFIT

Lessons Learned Through HBD: The Regulator’s View - US FDA

FDA-CDRH in the Next Decade A Vision for Change

Introduction to Soonr by ….

No No, Yes Yes: Simple Privacy & Information Security Tips Krista Barnes, J.D. Senior Legal Officer and Director, Privacy & Information Security, Institutional.

Community Oriented Approach to Population Health

HIPAA PRIVACY AWARENESS, COMPLIANCE and ENFORCEMENT

HIPAA and Data Storage, Handling, and Destruction

HIPAA Overview.

Columbus State’s Benefit Enrollment Portal (BenefitFocus)

Finding Patient Data for Research

Introduction to the PACS Security

TRACE INITIATIVE: Confidentiality, Data Security, and Procedures for Protocol Violation or Adverse Event.

Google Apps for Education

HIPAA Privacy and Some Research

New Research Access Processes IU Health Research Access Team Effective August 15, /18/2019.

Presentation transcript:

Data Management Planning for JHU SOM IRB Approval David Thiemann, MD (dthiema1@jhmi.edu) Medical Director, Center for Clinical Data Analysis JHU SOM IRB Data Management Consultant/Reviewer Associate Professor, Cardiology, Epidemiology and Health Sciences Informatics 14 July 2017

IRB Data Review Types/Triggers IRB Data Consultant Content review >=500 patients OR high-risk data JHU Legal Counsel/ Privacy Office Liability/compliance issues-rare De-ID, external sharing Information Security Technical review-rare Web apps, cloud apps, externally facing DB JHM Data Trust Research Sub-Council Stuart Ray, Chris Chute Policy review-rare External data sharing, conflict of interest

The Basics Store raw data/PHI on Enterprise storage (SAFE, REDCap) Study-specific folder on JHED/AD-enabled managed server JHBox (discouraged) No PHI on desktops, laptops, thumb drives, CDs Separate raw-data and (de-identified) analytic files No unencrypted data transmission (email) No external data sharing w/o specific permission No non-JHM tools (DropBox, Gmail)

IRB Data Management Documents: Plan, Data Security Profile, Data Dictionary Plan: 1-3 paragraphs Specifics, not a statement of good intentions Describe data methods/flow, not just storage Explain case finding, data sources Either Data Security Profile (simple projects) or Checklist (complex) Data Dictionary—list what will be collected

Common Mistakes Excel Shared pswd/access Using MRN as 1o key Portable, unauditable, no data typing Shared pswd/access Using MRN as 1o key No data dictionary “We’re going to abstract some charts” Back-channel/illicit data access Absurd data de-ID methods/promises No DIY de-ID for export Sample size fibs 498 patients of 5,000 Unrealistic EMR/Epic expectations Sipping from a dirty fire hose

Non-Epic Registries: New Data Trust Policy/Standards Coming Soon Def: Ongoing enrollment, >500 pts Excludes Registries required by law/regulation, operational systems, consented clinical trials, external registries Technical requirements: MS SQL Server at MTW, designated DBA, logging, monitoring by IT@JH security team JHED/AD authentication, MFA No unnecessary PHI: SSN, address, phone, email No self-service access. No umbrella IRB approval.

Useful URLs IRB Data Security Profile form (studies involving >=500 patients): http://www.hopkinsmedicine.org/institutional_review_board/forms/DataSecurityProfile.doc IRB Data Security Checklist form (for studies that do not comply with or meet the requirements of the Data Security Profile): http://www.hopkinsmedicine.org/institutional_review_board/forms/Data_Security_Checklist.doc JHM Privacy Office Use of Data Agreement (for data extracts from JHM enterprise databases, such as Epic, EPR2020, SCM and CaseMix): http://intranet.insidehopkinsmedicine.org/privacy_office/_docs/additional_information/Use%20of%20Data%20Agreement_012816_clean.pdf JHM encryption standards: http://www.it.johnshopkins.edu/restricted/standards/EncryptedStandardsRevisedAPPROVED030116.pdf