1. Biomedical Informatics Research Network DATA SHARING HIPAA Compliance & IRB Approvals Martha Payne, Jeffrey Grethe October 10, 2002 2 nd Annual All Hands Meeting

2. BIRN Sharing Scenarios  Private – not shared  BIRN Collaboration – shared with specific BIRN members  BIRN Consortium – shared with the BIRN scientific community

3. HIPAA Requirements – Human Data  Health Insurance Portability and Accountability Act  To provide for subject confidentiality  Protected Health Information 18 Identifiers (name, social security #, etc.)  De-identification (retain linkage list) vs. Anonymization (no linkage list) Both can be shared under HIPAA De-identified requires IRB waiver / exemption Anonymous data is IRB exempt  Stricter state laws take precedence (MN, MA, ?NY)  Disclosure – keep track of upload to BIRN only

4. Human Data – De-identified  Institutional Privacy Officer can hold linkage list (links BIRN and Subject ID) – Allows for IRB exemption  If individual investigators hold linkage lists – Need IRB waiver (cannot obtain IRB exemption)

5. De-identified or Limited Data Set  De-identify (remove 18 HIPAA identifiers) OR  Limited Data Set (partial removal of identifiers) with BIRN Data Use Agreement All BIRN sites enter into confidentiality agreement concerning human data  IRB exemption or waiver required for BOTH source and recipient sites

6. Prospective Data  Informed Consent sharing of full volumetric data (including facial features) share with BIRN Consortium (not specific sites or project groups)

7. One approach  Limited Data Set (allows for dates, exact ages)  BIRN consortium confidentiality agreement  Privacy officer holds linkages lists at each site  Need data descriptor variable

8. Issues to address  Computer security – HIPAA guidelines not yet issued  Face information for retrospective data how identifiable? (statistical test) contact OHRP obscure facial features  Determine means of enforcing data sharing guidelines