1 Research Involving Sensitive Data & Databases Brenda Cuccherini, Ph.D., MPH VA Office of Research & Development January 2007

2 Is This True? "The more the data banks record about each one of us, the less we exist” Marshall McLuhan Canadian philosopher & educator

3 Topics To Be Covered Sensitive data Database handbook –Definitions –Data Uses –Preparatory to research –One time use –Data Repositories Long term storage Re-use of data –Responsibilities

4 Definition: VA Sensitive Data & Information All Department data which requires protection due to the risk of harm that could result from inadvertent or deliberate disclosure, alteration, or destruction of the information. VA Handbook 6504 June 7, 2006

5 Examples of Sensitive Data Data when improperly used or disclosed could adversely affect the ability of an agency to accomplish its mission Proprietary information Records about individuals requiring protection under Privacy Act, HIPAA, or other statutes Information that can be withheld under FOIA

6 Applicability to Research VHA researchers develop, collect, use, share, &/or store all categories of sensitive data Researchers primarily think about protecting subjects’ and patient data and not other data Misuse or disclosure of other data may have a major impact on: –VHA and individual facilities –VHA’s ability to care for veterans & conduct research

7 Protecting Sensitive Data Careful thought Situational awareness “Universal Precautions” Guidance Policy

8 Draft policy: Use of Data & Data Repositories in Research (Draft Policy but Good Guidance)

9 A policy is a temporary creed liable to be changed, but while it holds good it has got to be pursued with apostolic zeal. Mohandas Gandhi

10 Scope of Database Handbook Applies to all research activities involving the use of data and data repositories that are conducted in VA approved research, within VHA, and/or by VA investigators while on duty. VA investigators maybe –Compensated –WOC –IPA Contractors: similar requirements will be in contract/SOW

11 Terms Defined for This Discussion Coded data DUA or Data Transfer Agreement Existing data De-identified data

12 Definition: Coded Data Information for which the source person can be identified through intermediate links (“coded”) used alone or in combination with other information.

13 Coded Date & Human Subjects Research Human subjects research: When individually identifiable information (III) is used –Individually identifiable information (38 CFR (f)): When the investigator can link data to specific persons directly or through codes. Common Rule definition differs from HIPAA definition of Individually Identifiable Health Information (IIHI) –Example: III=any information including religious beliefs; IIHI = physical health, mental health, or condition of the individual

14 Coded Data: Is It Non-human Subjects Research? Data not collected specifically for current research Code not based on the 18 HIPAA identifiers, e.g., last 4 digits of SSN, scrambled SSN, initials Investigator cannot readily ascertain identity of individual –Key to code is destroyed or the investigator cannot get access to the key –Investigator can not otherwise ascertain the identify of the individuals

15 Definition: Data Use Agreement ( Data Transfer Agreement (DTA) ) A written agreement that defines: –What data may be used –How data may be used –How it will be stored and secured –Who may access it –To whom it may be disclosed –Disposition of data after termination of research –Required actions if lost or stolen Requirement for DUA –HIPAA: when data disclosed outside the covered entity –Privacy Handbook (VHA ) disclosure outside of VHA Requirement for DUA or DTA –Database HB: any use of data by others

16 Definition: Existing Data Data that have already been collected when the research proposal is submitted to a VA reviewing committee

17 Definition: De-identified Data De-identified data must meet both the following definitions: HIPAA definition of de-identified –Removal of all 18 identifiers that could be used to identify the individual, individual’s relatives, employers, or household members Common Rule “definition” of de-identified –Removal of all information that would identify the individual or would be used to readily ascertain the identity of the individual

18 DATA AND ITS USES

19 Sources of Data Internal sources –Austin Automation Service –PBM –VistAWeb –BIRLS –Other administrative and clinical databases –Research databases External sources Research subjects

20 Uses of Data Preparatory to research Within a research protocol – Without reuse or storage – With plans for storage and reuse Populate a research data repository

21 Preparatory to Research Access only to prepare protocol prior to submission to IRB & R&D committee Can record aggregate data for background, justify the research, or show adequate number of subject available, etc. Cannot: –Record identifiers –Use information reviewed for recruitment or to conduct pilot studies

22 Preparatory to Research (cont.) PI must make representation per HIPAA –Access only to prepare protocol –No PHI removed from covered entity –Access necessary for research Documentation of representation placed in PI’s files

23 Use of Data For Research Protocol approved by: –IRB (if human subjects) & R&D Committee –Database administrator or “owner” Review by Privacy Officer or other expert –To ensure all Privacy Act, HIPAA and security issues are addressed Use must be consistent with the protocol Data can not be re-used or stored beyond the retention period, if not covered in protocol Consent and HIPAA Authorization Issues addressed, e.g., obtained or waived

24 RESEARCH DATA REPOSITORIES

25 Data Repository Data repository = storage & reuse Location: –At VA on VA servers –Permission required to house elsewhere Data sources: any –Research or non-research –VA or non-VA

26 Creation of Research Repositories Structure –Administrator or administrative board –Advisory committees (science, ethics) –Policies & procedures –IRB of record for oversight Content –Identified or de-identified data Location: within VA on VA servers unless waiver obtained

27 Repository SOPs Administrative structure Conflict of Interest Adding data to repository Accessing data Record keeping requirements Privacy & confidentiality Storage & security Termination of repository

28 Accessing Data from Repository Access by VA investigators Specific protocol that has IRB, R&D approval Protocol must contain required information (discussed later) DUA or Data Transfer Agreement

29 Record Keeping Sufficient Information to track & understand repository activity –How/where data obtained –Data requests and the associated protocols and approvals –Communications with the requester Administrative activities such as committee meeting minutes Communications to and from the IRB and R&D committee

30 Oversight of a Repository Annual reporting to the IRB (repository treated as a research protocol) and R&D committee Report information –Source of data being added –Type of data released to others including the protocol for reuse that contains information on: Confidentiality Storage and security of data Disposition of data at end of study –Any unanticipated problems regarding risk to subjects, institutions, etc. –Any incidents of inadvertent disclosure, loss, or theft of data

31 RESPONSIBILITIES

32 Investigator Responsibilities Protocols must contain information on –Source of data & type of data (identified, de- identified) –Consent under which it was collected –How the data will be used –Planned use of & justification for use of real SSNs – Recruitment or re-contact of subjects –Storage ( where, any copies, who will have access, plans to share data) –Justification for waiver of authorization or consent –Privacy & confidentiality related to data

33 Investigator’s Responsibilities (Continued) If data collected directly from subjects: –Consent clearly states: Use of data If reuse allowed Who will have access to data (VA investigators, non-VA investigators, drug companies, etc.) Where it will be stored How it will be secured Disposition of data after study Certificate of Confidentially –HIPAA authorization meets all requirements in VHA Handbook (more then HIPAA)

34 Investigator’s Responsibilities (Continued) Data use consistent with protocol No re-disclosure of data Appropriate training When leaving VA data and all copies left at VA All other responsibilities per VHA policy

35 Identifiable Data: Special Concerns SSNs – real and scrambled Recruitment of subjects Re-contacting subjects Storage & Security Privacy & Confidentiality – next session

36 Approvals for Research Using Data From a Repository Who is responsible? –The investigator(s) facility’s IRB and R&D Committee Who is NOT responsible? –The IRB and R&D Committee for the facility that houses the repository –The IRB and R&D Committee for the facility from which the data came

37 IRB Responsibilities Sufficient expertise to review the protocol Determining if the project is: –Research –If yes, is it human subjects research –If human subjects, is it exempt from IRB review (may still need HIPAA authorization) Requiring sufficient information All responsibilities under 38 CFR 16

38 “Sufficient Information” for IRB Source of the data & purpose originally collected (non-research, research) If research: is the re-use consistent with the informed consent & authorization If collected for non-research purposes, do guidelines under which collected allow re- use for research Appropriate permissions are obtained to access the data

39 “Sufficient Information” (Cont.) Description of the data (de-identified, identified, coded) Justification for use of identified data Coded data: a description of the coding scheme and who controls the key Use of real SSNs adequately justified Confidentiality and privacy issues addressed Recruiting or re-contacting subjects

40 “Sufficient Information” (Cont.) Major issue: Will the data be safe? –Storage –Security –Transportation or transmission –Copies of data (location, media) –Access (VA and non-VA persons) –Disposition of data at end of study (destruction, storage, etc.) Risks (subjects, institution, system)

41 Recruiting from Databases: IRB Considerations Must have IRB and R&D Committee approvals May not represent minimal risk Minimal risk if –Investigator is subject’s health care provider (HCP) –Initial contact from subject’s HCP –Initial approach is general (not disease specific or address sensitive issues) –Initial contact in person or by mail Minimal concerns if person has agreed to be contacted

42 R&D Committee Responsibilities Sufficient expertise to review science Receive & review “sufficient information” as described for IRB Review findings of the IRB If facility does not hold an FWA: –Determine if it is research –If research, determine if it is human subjects research –If any questions regarding this determination, develop procedures for consultation with human subjects experts

43 Responsibilities of Others Local P&P must be developed to ensure compliance with applicable VA & VHA policies Identify knowledgeable person(s) –Privacy Officer –IRB administrator –Research compliance officer –Data repository administrator Additional training of “knowledgeable persons” may be required –Role: to serve as final check for privacy & security issues

44 Just a Thought… “Big Brother in the form of an increasingly powerful government and in an increasingly powerful private sector will pile the records high with reasons why privacy should give way to national security, to law and order, to efficiency of operation, to scientific advancement and the like.” William O. Douglas Associate Justice U.S. Supreme Court From

45 A prudent question is one-half of wisdom. Francis Bacon

46 "To care for him who shall have borne the battle and for his widow and his orphan.“ Abraham Lincoln’s Second Inaugural Address “…To care for him who shall have borne the battle and for his widow and his orphan." Abraham Lincoln