1. PCOR Privacy and Security Research Scenario Initiative and Legal Analysis and Ethics Framework Development Welcome and Please Sign In »Please sign into the WebEx using your name and affiliation and/or record your name on the conference line after the prompt. »If you are not signing on to the WebEx, signing on anonymously, or did not record your name on the conference line, please email Donaldson- Katherine@norc.org to let us know you are on the phone.Donaldson- Katherine@norc.org Participation »Please keep your own line muted throughout. »If you have a question, please raise your hand via the web and we will call upon you. 1

2. Patient Centered Outcomes Research (PCOR) Privacy and Security Research Scenario Initiative and Legal Analysis and Ethics Framework Development Stakeholder Work Group Meeting #2 December 16, 2015 NORC at the University of Chicago The George Washington University

3. Meeting Agenda Welcome Scope Discussion (10 minutes) Charter Review (10 minutes) Research Data Use Scenarios (30 minutes) »Review of Detailed Development Process »Detailed Discussion of Possible Scenario Topics and Issues for Consideration Next Steps Communication (5 minutes) »“Rules of Engagement” »Communication Mechanisms 3

4. Charter Review and Scope Discussion Prashila Dullabh 4

5. Project Charter Project Context PCOR Working Definition Goals Target Outcomes In Scope* Out of Scope* 5

6. Project Charter: Context How health information derived from a wide variety of data sources can be used for PCOR and CER, consistent with ethical principles and legal and regulatory requirements related to patient consent, privacy, and autonomy Phase 1: development of research data use cases Phase 2: development of legal and ethical framework Phase 3 (a separate, but related project): identifying or developing technical standards for capturing patient choice 6

7. Project Charter: Framing of PCOR PCOR is research that incorporates: »Advanced approaches to assessing provider and patient preferences, health-related quality of life (HRQoL), clinical efficacy, potential side effects of treatment and drug therapies, and the impact of patient genetic predisposition and »The capacity to capture, manage, and analyze data from providers and patients PCOR’s goal is to produce findings that give patients and providers an individually tailored view of their treatment options and the possible benefits and harms associated with a particular course of action, allowing the patient and provider(s) to make informed decisions about the patient’s health and healthcare 7

8. Project Charter: Goals Develop research data use scenarios that describe how data from providers and patients is captured, managed, and used Ensure that the research data use scenarios address key issues that researchers face, are representative of practical industry-wide needs, and are valuable for solving real-world PCOR/CER challenges Describe how users and systems interact to identify data-sharing and system interactions and requirements across the research community Leverage federal and private sector work in developing the research data use scenarios Analyze various operational elements, technical policy requirements, tasks, activities, and information-sharing necessary to support the PCOR/CER community 8

9. Project Charter: Outcomes and Scope Target Outcomes »15-20 priority research data use scenarios that describe user actions, system interactions, and information-sharing requirements for PCOR/CER In-Scope* »Data Types: clinical and administrative data, patient-generated health data, genomic data, bio-specimens, behavioral health data, survey data, social determinants of health, and data from special populations of interest, including under-represented and culturally diverse populations »May consider issues related to data characteristics (identifiability, type, source), data handling (storage, transmission, collection), data uses (purpose, scope of consent), the users and facilities interacting with the data (collector, data user, location of collection and use), as well as others raised by the work group 9

10. Project Charter: Scope Out of Scope* »Data use scenarios focused on provider or payer operations, nor on educational records »Issues of data “ownership” —the focus will be on enabling data use for advanced research »Identifying or developing solutions, technical or otherwise—this will be the work of other planned and future initiatives Please indicate if there are any areas on the project scope and charter that need clarification. 10

11. Process for Developing Research Data Use Scenarios Ioana Singureanu and Daniella Meeker 11

12. Focus of the Research Data Use Scenarios Identifying the policy, legal, and ethical components and requirements to support data use in PCOR and CER while protecting patient privacy. We will focus on: »Identifying research data use scenarios that are person-centric and encompass PCOR and CER »Identifying necessary policies and requirements to enable data use in research »Defining the gaps and needs in policies and ethical and legal requirements »Identifying instances where technical components intersect policy requirements, referencing relevant technical specifications, as needed 12

13. Use Case Development Process 13

14. Examples of Other Possible Research Data Use Scenario Topics Data collection and sharing for research purposes Merging large databases for research purposes Research related to precision medicine Research/information sharing within and across multiple entities/institutions Laboratory data for research purposes Patient-generated data used for research purposes Familial/community implications of research data collection and use Please discuss if there are other topic areas that should be included. 14

15. Example 1: Consent on Behalf of a Minor in a Longitudinal Cohort Study TitleConsent on behalf of a minor DescriptionIn longitudinal cohort studies, a mother may consent on behalf of an infant to provide a large number of data elements repeatedly to a registry intended to be reused for multiple purposes. Over time, multiple copies of the data may be distributed to researchers for multiple purposes. At the time the child becomes an adult, he wishes to continue to allow academic researchers to access data, but not researchers from corporations or insurance companies. He also would like to withdraw sensitive data about childhood mental health from the records. What mechanisms could be in place to track and inform mother and child about reuse? What mechanisms could be in place for the child to withdraw consent only on the type of researcher that might access his data? Data Elements ConsideredAnnually renewed self-report, clinical, genetic data Purpose Of Data CollectionCreation of a database for reuse in multiple studies Purpose Of Data UseDetermined on the basis of each study Terms Of Transfer To Data Holders Identifiable data included for re-contact Terms Of Data Release To Researchers Direct identifiers not available 15

16. Example 2: Policy Change, Consent Maintenance, and Change Management TitleConsent Maintenance and Change Management DescriptionA large academic medical center notifies patients at the time of registration that data may be used for research with an option to opt-out. A data warehouse was created to help investigators identify subjects that are eligible for clinical trials, including PHI. In 2008, the hospital began issuing paper-based consent for re-contact forms for research purposes (opt-in). Consistent with expectations, this approach reduced participation by 60%. What mechanisms could be in place for withdrawing consent? What mechanisms should be in place to ensure that patients can restore consent to be contacted for trials (e.g., after a terminal diagnosis)? How should data that is already included in the research data warehouse be managed after policy changed from opt-out to opt-in? Data Elements ConsideredElectronic health record data Purpose Of Data Collection Clinical care Purpose Of Data UseEligibility screening and re-contact for trial enrollment Terms Of Transfer To Data Holders Changed between original data capture and Terms Of Data Release To Researchers IRB approval 16

17. Example 3: Exploratory Data Mining and Merging TitleExploratory Data Mining and Merging DescriptionA data scientist wishes to conduct an exploratory data analysis of transactional clinical data from an Electronic Health Record of a Medical Center she is not directly affiliated with. She does not have a particular hypothesis in mind. Instead, she is looking for patterns that might lead to promising avenues for future research. To explore public health and social determinants of health, she has identified a number of data sets with geocoded information about pollution, socioeconomic circumstances, and traffic that she proposes to link using patients addresses. To obtain longitudinal clinical outcomes outside of the original clinical system, she has contacted three insurers that can also provide information about the patients’ employers and care received. Data Elements ConsideredAll data elements from all patients in an electronic health record, data from claims, data from publicly available data sets Purpose Of Data CollectionClinical care, census information, and payment Purpose Of Data UseNon-specific hypothesis generation Terms Of Transfer To Data Holders Multiple data holders: clinical operations, public health, payment Terms Of Data Release To Researchers Terms of Institutional Review Board and compliance offices of parties involved. 17

18. Example 4: Clinical Data Research Network Infrastructure TitleClinical Data Research Network Infrastructure DescriptionPCORnet enables a consortia of covered entities to collaborate in the analysis of transactional data generated during the course of care. The terms of the PCORnet research network contract involve creating and maintaining a research store, including a limited data set with all patients’ data. Research staff must transform these data into a common, interoperable format, referred to as a “common data model”. Creating this store expensive Typically grant or contract principals are informatics researchers This is not considered part of healthcare operations Future work using these data is expected to create publications Significant heterogeneity across PCORnet regarding whether moving and transforming data is considered research by compliance offices/IRBs Data Elements ConsideredAll clinical data elements in a common data model from an unselected sample of patients (diagnoses, procedures, demographics, labs, etc.) Purpose Of Data CollectionFuture research in multiple projects Purpose Of Data UseResearch, unspecified at the time of data movement. Terms Of Transfer To Data Holders Clinical operations copy data into a repository devoted to research Terms Of Data Release To Researchers Terms of an IRB approval or subsequent consent 18

19. Wrap-up and Next Steps Prashila Dullabh 19

20. Review of Progress Summary of major decision points »Scope »Charter »Research data use scenarios Materials will be posted on Confluence »You will receive links to relevant documents via email »We will revise and post the updated versions by our next meeting Next meeting: Wednesday, January 6, 2016 20

21. Communication Mechanisms Email »Meeting invitations »Meeting materials »Links to Confluence pages when materials are available for review Confluence »All documents for review and active comment »Calendar »Past agendas and summary notes »Resources: FAQs, glossary 21

22. Meeting Schedule Calendar invites will be sent out for the following dates: 22 Meeting 1 (kickoff)Tuesday, December 1, 2015 Meeting 2Wednesday, December 16, 2015 Meeting 3Wednesday, January 6, 2016 Meeting 4Tuesday, January 19, 2016 Meeting 5Wednesday, February 3, 2016 Meeting 6Wednesday, February 17, 2016 Meeting 7Wednesday, March 2, 2016 Meeting 8Wednesday, March 16, 2016 Meeting 9Wednesday, March 30, 2016 Meeting 10Wednesday, April 6, 2016 Meeting 11Wednesday, April 20, 2016 Meeting 12Wednesday, April 27, 2016

23. @ONC_HealthIT@HHSONC Thank You

24. Appendix 24

25. Related ONC PCOR Projects Structured Data Capture »Identify and develop the functional and technical specifications necessary to –Enable an EHR system to retrieve, display, and fill a structured form or template –Store/submit the completed form to an external repository Data Access Framework »Establish the functionality to extract EHR data in a consistent and reproducible way –Within an organization’s EHR –From an external organizations EHRs –From EHRs across multiple organizations 25

26. Related ONC PCOR Projects Patient Generated Health Data »Develop a policy framework for the use of PGHD in research and care delivery that addresses –Needed data collection tools, data donation policies, regulatory gaps, combining PGHD data with medical record data –Interoperability of PGHD across multiple health information systems and devices Patient Matching, Aggregating and Linking »Identify the best patient attributes to standardize for matching patients to their data across clinical, and claims data sets »Identify algorithms to reliably perform patient matching in these contexts –To address the challenge of linking patient data across research, claims, and clinical data sets 26