NIH Distributed Research Network

Transcription

1 NIH Distributed Research Netwrk POLICIES AND PROCEDURES 10/23/2013

2 Table f Cntents 1. Intrductin Purpse f this dcument Backgrund Organizatinal Structure Rles and Respnsibilities NIH DRN Crdinating Center Data Partners Requestrs Netwrk Rles Plicies and Prcedures Data Queries/Requests Data Cmpleteness and Data Characterizatin Activities Questinnaires and Targeted Questins Analyses with Aggregate Results Analyses with Persn-level Data Data Request Fulfillment Standard Queries Summary Table Queries Mdular Prgram Requests EHR Supprt fr Public Health (ESP) Queries Custmized Queries Meta Data Requests and Surveys Security Plicies Cmmunicatins Disseminatin f Results Cnfidentiality Attachment A 11 Distributed Research Netwrk i

3 1. Intrductin 1.1 Purpse f this dcument This dcument prvides an verview f the NIH Health Care System (HCS) Distributed Research Netwrk (DRN) gvernance plicies, querying capabilities, and respnsibilities. The plicies and prcedures described are develped by the NIH DRN Gvernance Advisry Cmmittee and apprved by the HCS Cllabratry Steering Cmmittee, and thers as directed by the HCS Cllabratry Crdinating Center hused at the Duke Clinical Research Institute (DCRI). These plicies apply t NIH DRN activities, prviding guidance n cllabratin in the use f electrnic health data, while als safeguarding prtected health infrmatin and prprietary data. These plicies d nt address r replace prcedures and gvernance f individual research prjects funded as part f the NIH HCS Research Cllabratry. Plicies regarding funding fr NIH DRN activities are addressed elsewhere. 1.2 Backgrund The NIH Cllabratry s Electrnic Health Recrds (EHR) Cre is respnsible fr creating and verseeing the NIH DRN. The NIH DRN is described in detail here: In brief, the NIH DRN is a cllabratin enterprise cmprised f sftware, plicies, and prcedures that facilitate research partnerships thrugh secure distributed querying f health data held and secured by the NIH DRN Data Partners. The netwrk is administered by the NIH DRN Crdinating Center (CC), which als prvides query supprt and ther services t facilitate use f the Netwrk. The NIH DRN can facilitate the frmatin f research partnerships by enabling requestrs (thse requesting infrmatin) t identify and cntact ptential Data Partners (rganizatins that maintain electrnic health data) t identify pprtunities fr cllabratin n specific prjects. Data Partners may include thse inside r utside the NIH DRN. When requestrs and Data Partners agree t cllabrate, they wrk tgether t answer the questins. The netwrk is best used t facilitate multi-site research and des nt preclude initiatin f partnerships r cnduct f research utside the netwrk, even if research partners are identified using the netwrk. This dcument fcuses primarily n plicies and prcedures fr querying t supprt identificatin f ptential research partnerships. 2. Organizatinal Structure The EHR Cre reprts t the HCS Cllabratry Steering Cmmittee. The Cre is cmpsed f individuals appinted by the HCS Cllabratry Steering Cmmittee. Overall respnsibilities f the EHR Cre include develping and perating the NIH DRN, engaging with the Phentypes/Data Standards Cre, identifying ways t assist the Demnstratin Prjects, and prviding guidance t the HCS Cllabratry Steering Cmmittee. The EHR Cre als versees the activities f the NIH DRN Crdinating Center as described belw. Distributed Research Netwrk 1

4 3. Rles and Respnsibilities 3.1 NIH DRN Crdinating Center The NIH DRN CC resides in the Department f Ppulatin Medicine (DPM) at the Harvard Pilgrim Health Care Institute (HPHCI) and is respnsible fr the day-t-day peratins f the NIH DRN. NIH DRN CC staff members have expertise in the use f electrnic health data, epidemilgy, health services research, statistics, sftware develpment, and peratin f distributed netwrks. The activities f the NIH DRN are verseen by the EHR Cre. NIH DRN CC respnsibilities include: Query Supprt Develp and versee the query request, apprval, and respnse prcess Prvide NIH staff and ther requesters with supprt regarding use f the Netwrk, querying capabilities, data resurces, and interpretatin f results. Supprt als includes data fitness fr use and epidemilgic expertise. Review submitted requests fr apprval Ensure that all data requests are tested and apprpriate fr use within the Netwrk and with the specific Data Partners invlved (see Query Capacity and Fulfillment) Query Capacity and Fulfillment Create the capability and expertise t use publicly available tls, including, but nt limited t, thse develped by the FDA Mini-Sentinel prject ( by ESPnet ( and the existing querying features f the pen surce versin f PpMedNet ( Tls available include the Mini-Sentinel mdular prgrams, summary table queries, and ther prgrams based n the Mini- Sentinel Cmmn Data Mdel and ESPnet data mdel. Capacity t prcess an agreed upn number f requests, by type f request, per mnth, as directed by NIH (See Attachment A) Wrk with Data Partners t establish their engagement and agreements/ cntracts and assist with query respnse The NIH DRN CC will establish a respnse and reimbursement agreement with Data Partners regarding the prcess fr apprving and respnding t queries. Agreements will address: Prcedures that ensure Data Partners ability t review and apprve queries and results Identificatin f pre-apprved query types (e.g., Mini-Sentinel mdular prgrams) Expectatins regarding timeliness f respnses Cmpensatin by NIH Review and editrial rights f reprts and publicatins, including but nt limited t data prvided, shwn, and interpretatins Apprpriate acknwledgement by investigatrs n publicatins and reprts Separate prcedures, timelines, and cmpensatin schedules will be develped fr: 1) requests that use pre-apprved query types and return nly aggregate results; and 2) requests that use new prgrams r require additinal wrk n the part f Data Partners. Examples f pre-apprved request types include requests that use Mini-Sentinel s summary tables r mdular prgrams, r ESP menu- Distributed Research Netwrk 2

5 driven queries. Data Partners will have different sets f pre-apprved query types; that is, nt all pre-apprved query types will be available at all Data Partner rganizatins. Wrk with Data Partners wh have data mdels fr which pre-apprved query types d nt currently exist (e.g., i2b2, HMORN VDW, OMOP) n: 1) ways t participate in these activities; and 2) develp pre-apprved queries that will be acceptable t data partners. An NIH DRN CC representative serves as the Netwrk Administratr. The Netwrk Administratr establishes all users n the NIH DRN and assigns each user his/her rle, as defined in the NIH DRN gvernance dcument (see Sectin 3.4). The Netwrk Administratr als deletes users, as needed (per cmmunicatin received by DataMart administratrs), and is respnsible fr the verall functining f the Netwrk. Netwrk Maintenance and Sftware Incrprate sftware updates and bug-fixes Secure hsting and maintenance Expand the Netwrk s capabilities (e.g., expanded meta-data capture and search functins, ability t stre, tag, and share analytic cde with prper access cntrls) Additinal Activities Cllabrate with the NIH Cllabratry s Data Sharing Wrk Grup t help implement unifrm data sharing principles and use f analytic datasets Request infrmatin frm Data Partners related t data availability and fitness fr use Write distributed prgrams t be run at Data Partner sites, bth fr quality assurance and apprved queries Apprve, priritize, test, and execute apprved requests Develp and versee the query request and respnse prcess Ensure that dcumentatin n Data Partners site characteristics, data availability, and quality are available internally and publicly Ensure all data queries/requests have a prtcl/research prpsal, apprpriate IRB apprval, and are submitted by an apprved requestr Prvide Data Partners with detailed descriptins f each request and the intended use f the results, including, as apprpriate, a descriptin f relevant prtcls, IRB apprval, and apprved requestr 3.2 Data Partners Data Partners are member rganizatins that have electrnic health data resurces and the technical capacity t respnd t a query via the NIH DRN. Sme f the Data Partners have the ability t respnd t rapid-respnse queries. Data Partners are nt required t have data stred in a particular frmat r data mdel. Data Partners will identify which data mdels they supprt (e.g., Mini-Sentinel, i2b2, HMORN VDW, OMOP) and what types f pre-apprved requests they are willing and able t prcess. The NIH DRN CC will nly send requests t Data Partners wh have self-identified as having the ability and willingness t respnd t such requests. Each NIH DRN Data Partner pssesses data acquired thrugh its primary business activities (referred t herein as riginal surce data ), including but nt limited t administrative medical and pharmacy claims data, utpatient and inpatient electrnic health recrds (EHRs), Distributed Research Netwrk 3

6 demgraphic infrmatin, utpatient pharmacy dispensings, and registry data. In additin, sme Data Partners pssess research data sets and will wish t make thse resurces available fr querying. This may include data develped as part f a clinical research trial r ther activity that generates a reusable analytic dataset. Each Data Partner will retain physical and peratinal cntrl ver its data and manage and stre the data in accrdance with its wn institutinal plicies Data Partner Expectatins Expectatins fr Data Partners include: Identify lcal staff t serve as Site Principal Investigatr (PI), Site prject manager, and Site analyst Maintain lcal data mdel(s) Meet all f the cmpliance requirements applicable t their lcal sites Assign ne r mre lcal analyst t receive and respnd t queries/requests Respnd t all queries/requests per agreed upn guidelines (see Attachment A) Maintain a list f its current staff wh are authrized t participate in the NIH DRN, their cntact infrmatin, and their rles and respnsibilities within the Netwrk Obtain and maintain lcal apprval related t participatin in NIH DRN activities Obtain necessary human subjects apprvals, as apprpriate, based n the request and prject (e.g., when recruitment f study participants is required) Install and maintain the PpMedNet sftware Ntify the Netwrk Administratr at the NIH DRN CC when any authrized user shuld have his/her access remved (e.g., due t a change in emplyment r rle change) NIH DRN Data Partner PIs The NIH DRN Data Partner PIs: Meet all agreement/cntractual requirements and ensure that applicable lcal Site cmpliance requirements are met. This includes, but is nt limited t, assuring that secure data strage and transfer are cnducted in accrdance with lcal, state, and federal regulatins, as well as in accrdance with institutinal plicies and prcedures. Create a prcess fr deciding whether r nt t participate in a query/request Respnd in a timely and cmplete manner t NIH DRN CC queries/requests (see Attachment A) Cmmunicate clearly and in a timely manner t the NIH DRN CC if they chse t pt ut f an activity NIH DRN Data Partner Prject Managers Data Partner prject managers are expected t: Liaise between the NIH DRN CC and their Sites Attend relevant meetings Cmmunicate with their lcal Site PIs t ensure applicable lcal Site cmpliance requirements are met Distributed Research Netwrk 4

7 3.2.4 NIH DRN Data Partner Analysts Data Partner analysts will: Respnd t queries/requests frm the NIH DRN CC within the specified timeframe, as directed by the Site PI r lcal apprval wrkflw Prvide dcumentatin t the NIH DRN CC n Site-specific data issues Fllw established prcedures fr data queries/requests Attend calls and meetings, as needed 3.3 Requestrs Authrized requestrs include NIH Cllabratry leadership and the Data Partners, and ther individuals/rganizatins designated by NIH Cllabratry leadership. All requestrs must adhere t the respnsibilities and expectatins utlined belw. All queries/requests will be reviewed by the NIH DRN CC. If apprved by the NIH DRN CC, all queries/requests will be submitted by the NIH DRN CC staff t the Data Partners thrugh the NIH DRN secure Query Tl. Requestrs are respnsible fr: Cmpleting request frms Clearly describing the nature f the request and the intended use f the findings, including grant r ther funding applicatins Respnding t requests fr clarificatin frm the NIH DRN CC and the EHR Cre Obtaining necessary apprvals by IRBs and HIPAA privacy bards Wrking with NIH DRN CC and Data Partners t execute necessary agreements/cntracts Requestrs are expected t: Use results prvided nly fr the stated and apprved purpse. This may include a requirement t keep results cnfidential. Abide by any ther limitatins n use, issued by the EHR Cre, the NIH DRN CC, and/r the Data Partner prviding and reprting data 3.4 Netwrk Rles The fllwing are Netwrk rles that are assigned by the Netwrk Administratr based n Netwrk plicies. 1. Netwrk Administratr: in accrdance with the NIH DRN Gvernance Advisry Cmmittee, can add apprved member rganizatins; create grups and rles; add/delete Netwrk participants; re-set passwrds; and view all queries submitted. The Netwrk Administratr has cmplete access t the Netwrk and all its functins. This rle is assigned t the System Hst and Sftware Manager and ne r mre representatives (r delegates) f the NIH DRN Crdinating Center. 2. Grup Administratr: is able t review, aggregate, and release results fr the grup. A grup f data partners can designate a persn as the grup administratr and select rules that require the grup administratr t review grup results befre the results are released t the requestr. Results can be released individually r as an aggregate. Netwrks d nt require a Grup Administratr; this rle is fr cnvenience f affiliated grups f data partners. Distributed Research Netwrk 5

8 3. DataMart Administratr: manages the DataMart preferences n the Prtal and lcal DataMart Client (e.g., what data can be queried and by whm). There can be ne r mre DataMart Administratrs per Data Partner. DataMart Administratrs cannt send queries t ther DataMarts. A DataMart Administratr manual is available t prvide instructins n hw t use and interact with the NIH DRN. DataMart Administratrs are respnsible fr cmmunicating with the Netwrk Administratr t make requests fr adding r remving participants (e.g., remving access fr terminated emplyees). Each Data Partner must assign ne r mre DataMart Administratrs and prvide the Netwrk Administratr with the names and cntact infrmatin fr each. 4. Observer: users wh have rights t view query activity within specific prjects, including query descriptins, parameters, and statuses. Observers als have rights t view netwrk infrmatin, including participating rganizatins, users, and DataMarts. Observers d nt have the rights t view query results. 5. Requestr: can submit queries t DataMarts that have given them r their member rganizatin permissin t submit queries (see Sectin 3.3). 4. Plicies and Prcedures 4.1 Data Queries/Requests The prcedures utlined belw are designed t balance efficiency and Data Partner autnmy. The NIH DRN CC can help determine which kind f query/request is mst apprpriate fr each situatin. Fr each query/request, there are fur steps: initiatin, apprval, executin, and reprting. Regardless f the apprach, the fllwing infrmatin will be required frm the requestr(s): details fr the request, purpse f request, intended use f results, expected level f PHI in the respnse, and date by which infrmatin is needed. All requests must be submitted n the standardized frm t the NIH DRN CC, which tracks riginatin and final dispsitin f all requests. (See 4.2 Data Request Fulfillment) Data Cmpleteness and Data Characterizatin Activities The NIH DRN Crdinating Center will issue queries/requests t ensure prper system functinality and t help characterize data available within the NIH DRN. These requests will nly apply t data that the Data Partners maintain in a supprted data mdel. Results f these queries will be used, in aggregate, t describe the breadth and depth f data in the NIH DRN and als t help infrm the NIH DRN Crdinating Center regarding issues related t data availability, capture, and fitness fr use. The NIH DRN Crdinating Center will create and annually update a data characterizatin reprt t help characterize NIH DRN data t assist requestrs in identifying apprpriate data partners fr prpsed studies Questinnaires and Targeted Questins Sme requests may take the frm f a questin r brief questinnaire (e.g., questins regarding the expected electrnic capture f the prvisin f specific prducts r services, such as infused therapies r grup therapy) t help identify pssible data surces r expected gaps in data capture. These requests will nt generate persn-level infrmatin but culd invlve infrmatin that Data Partners cnsider cnfidential r prprietary. If the respnse is deemed cnfidential/prprietary, Data Partners shuld indicate s in the respnse, and apprpriate prtectins shuld be made Analyses with Aggregate Results Distributed Research Netwrk 6

9 Sme analyses yield nly aggregate data (e.g., cunts, regressin results), i.e., n persn level data, and n cell sizes less than 6. Aggregate data can be subcategrized by demgraphics (e.g., sex, age grup), perid (e.g., mnth, year), and health service characteristics (e.g., cmrbidity scre). These analyses may be perfrmed fr prject planning, prpsal develpment, r because the results themselves are meaningful withut requiring any additinal analysis. Examples f requests include: Cunts f members meeting certain criteria (e.g., wmen ver 40 years ld wh have filled an antidepressant prescriptin) Cunts f expsures, utcmes, r expsure/utcme pairs Cunts f members with varius health plan characteristics (e.g., enrllment mnths r medical benefits, pharmacy benefits) Rate f an utcme fllwing expsure t a medical interventin Analyses with Persn-level Data Sme analyses result in the sharing f persn-level data, and requestrs and Data Partners will agree in advance abut such activities perfrmed as part f an NIH DRN apprved request. As needed, an agreement/cntract will address the level f participatin by Data Partners as cllabratrs in the activity, the number and type f requests that will be included, respnse schedule, and reimbursement. Request executin will require existence f apprpriate apprval by IRBs and HIPAA privacy bards. 4.2 Data Request Fulfillment The NIH DRN CC will facilitate identificatin f tpic-apprpriate data resurces available within the NIH DRN, aid in develping requests, and supprt query distributin t implement apprved research prtcls. The NIH DRN perates under an pt in mdel. That is, n participating Data Partner will be expected t participate in research activities withut the apprval and invlvement f an investigatr at that Data Partner s site. It is expected that Data Partners will engage with requestrs and in activities that yield nly aggregate data. Data Partner rganizatins and requestrs are nt mutually exclusive; Data Partners can als be requestrs and can cllabrate with ther Data Partners/requestrs n specific prjects. All data requests must be submitted t the NIH DRN CC using the NIH DRN request frms. The NIH DRN CC will cnduct an administrative review t determine apprpriateness f the query/request. This may invlve clarificatin f the request with the requestr, and determinatin f apprpriateness with relevant Data Partner Site PIs. In general, the NIH DRN CC will act primarily as a tracking and priritizatin mechanism. The NIH DRN CC will wrk with the requestr t select the mst apprpriate mechanism fr respnding t each request. Once a request is apprved by the NIH DRN CC, the CC will initiate the request, manage the request prcess, and prvide the results t the requestr. Distributed querying is typically accmplished thrugh the fllwing six steps: 1) The requestr develps a questin; 2) The requestr sends the questin t the NIH DRN CC, using the NIH DRN request frm, fr distributin (via the NIH DRN prtal) t ptential cllabrating Data Partners; 3) Each Data Partner determines whether r nt t answer the request and whether r nt an agreement with the requestr is needed; 4) Data Partners use their lcal datasets t btain results; 5) Data Partners securely send results t the NIH DRN CC using the NIH DRN; Distributed Research Netwrk 7

10 6) The NIH DRN CC reviews the results and submits the respnse t the requestr. Results are ften aggregate results, withut cnfidential r prprietary data. The level f data sharing is determined, in advance, as part f the cllabratin agreement, and all query respnses can be reviewed by the Data Partner befre they are released Standard Queries Standard queries refer t a series f specific query types/appraches that are supprted by the NIH DRN CC and that can be pre-apprved by the Data Partners as an acceptable frm fr standard querying. These query types have several imprtant characteristics, including 1) the use f standardized query frms, 2) generatin f query results in standardized frmats, 3) use f an apprved query cde and system tested and maintained by the NIH DRN CC, and 4) use f a query apprach tested and accepted by Data Partners. Data Partners will nly receive query requests that use query types that they have agreed t accept. There are currently three types f standard queries supprted by the NIH DRN CC (listed belw). Data Partners must identify which f these query types they are willing and able t receive and respnd t quickly. Additinal standard query types will be added as new functinality is develped and new mdels are adpted by Data Partners Summary Table Queries The NIH DRN can query pre-cmpiled tables created and maintained by the FDA Mini- Sentinel prgram. These include nine types f prevalent cnditins r treatment queries, three types f incident cnditins r treatments queries, and several Mst Frequent Utilizatin queries Mdular Prgram Requests The NIH DRN can use standardized, mdular SAS prgrams that allw requesters t execute standardized analyses using individually selected parameters (e.g., expsures, utcmes, query perid, age grups, etc.) that can be mdified fr each request. The prgrams themselves are nt mdified, nly the parameter file used in the request changes. Seven mdular prgrams have been develped and published by the FDA Mini-Sentinel prgram; these can be executed against the Mini-Sentinel Cmmn Data Mdel. Additinal mdular prgrams may be created by the NIH DRN t perfrm additinal analyses and/r t perate n different data mdels EHR Supprt fr Public Health (ESP) Queries The NIH DRN can use a simple query interface, the ESPnet Query Builder, t query data frmatted accrding t the ESPnet data mdel. These queries can execute against the ESP data mdel Custmized Queries Custmized prgrams may be necessary t address questins nt answerable with standard queries, either because the questin requires different kinds f analysis, r t wrk with a data mdel that the standard queries d nt supprt. These prgrams may be develped by the NIH DRN CC, in cllabratin with the requestr, r by the requestr, if the requestr has expertise in prgramming in the NIH DRN data envirnment. As with all requests, the NIH DRN CC must apprve the allcatin f resurces t develp the query t fulfill a data request. Once apprved, the query will be develped and tested by the NIH DRN CC. The NIH DRN prtal will be used t distribute these requests, and t return results. Data Partners will be ntified abut the develpment f custmized queries and will participate n an pt-in and case-by-case basis. Distributed Research Netwrk 8

11 4.2.3 Meta Data Requests and Surveys Sme requests d nt require access t data, but rather fcus n health plan characteristics r ther nn-data infrmatin. The NIH DRN CC will wrk with the requestr t assess the viability and preferred apprach fr cllecting this type f infrmatin. Examples include frmulary status changes, insurance prduct fferings, and ppulatin characteristics. 4.3 Security Plicies The NIH DRN will cmply with all applicable federal, state and prfessinal standards, including thse prmulgated by the HIPAA and NIH. The fllwing list cntains majr security plicies f the system: Users are required t select strng passwrds with the fllwing rules at minimum: at least eight characters, at least ne number, at least ne nnnumeric character, at least ne capital letter, at least ne lwer case letter. Passwrds cannt cntain the username r any part f the Netwrk participant s full name. Passwrds will be changed at least every six mnths Passwrds cannt be re-used Cmputers will be autmatically lcked dwn r lgged ff at maximum after thirty minutes f inactivity The NIH DRN System Administratrs will verify NIH DRN participants identities and addresses befre creating new user accunts Users must use crprate addresses fr NIH DRN cmmunicatin All NIH DRN activity will be lgged (a recrd will be kept f access, user identificatin [ID] changes, query initiatin, results uplad, etc.) NIH DRN CC will regularly review audit lgs Antivirus sftware will run regularly n all NIH DRN system servers Data Partner analysts will be able t create audit lgs f all f their NIH DRN activity System cmmunicatin will use Hypertext Transfer Prtcl Secure/Secure Scket Layer (HTTPs/SSL/TLS) standards The NIH DRN will be hsted in a secure, FISMA cmpliant data center 5. Cmmunicatins Query requests shuld be initiated as described abve (sectin 4.1). Questins r cmments t the NIH DRN Gvernance Advisry Cmmittee can be addressed t Beth Syat (beth_syat@harvardpilgrim.rg). The NIH DRN Gvernance Advisry Cmmittee will meet regularly and disseminate infrmatin thrugh regular updates t the HCS Cllabratry Crdinating Center and n Steering Cmmittee calls. 5.1 Disseminatin f Results The EHR Cre will regularly publish descriptive statistics and quality assurance measures n the public prtal, with the permissin f each Data Partner PI and the HCS Cllabratry Crdinating Center. Distributed Research Netwrk 9

12 6. Cnfidentiality Prtecting cnfidentiality f data is a critical cmpnent f the NIH DRN. This gvernance dcument pertains t the wrk f the EHR Cre nly. Each query/request will have the apprpriate and necessary human subjects apprvals and fllw cnfidentiality prcedures. The NIH DRN Crdinating Center will request nly the minimum necessary infrmatin and use aggregate data first t answer queries. Under n circumstances will identifiers, as defined by HIPAA, be included in a data set. Identifiers include name, Scial Security Number, medical recrd number, and address (excluding ZIP Cde). Numbering schemes that cannt be assciated with any f the abve identifiers may be intrduced fr linking data frm individuals. Distributed Research Netwrk 10

13 Attachment A The purpse f this dcument is t serve as a placehlder fr describing specific infrmatin abut query capacity f the NIH DRN s Crdinating Center and data partners. This is a living dcument that will be updated t reflect currently-agreed upn terms. As f [date]: - The NIH DRN Crdinating Center will prcess up t X mdular prgram requests and up t X summary table requests r ther menu-driven, rapid-respnse requests per mnth, as directed by NIH. - Data Partners will respnd t: Summary table requests r ther menu-driven rapid-respnse requests: prcess up t X per mnth and respnd within X wrking days r prvide a reasn fr nt respnding Mdular prgram requests: prcess up t X per mnth and prvide ne f the fllwing respnses within X wrking days f receipt f a prgram: Accept query and run it within alltted timeframe; Ask fr additinal infrmatin; r Reject query and prvide a reasn Distributed Research Netwrk 11