Data sharing and data agreement lecture.ppt
- 1. DATA SHARING and DATA SHARING AGREEMENTS 1
- 2. ● Definition • A data-sharing agreement is a formal contract that clearly documents what data are being shared and how the data can be used. Such an agreement serves two purposes. First, it protects the agency providing the data, ensuring that the data will not be misused. • Second, it prevents miscommunication on the part of the provider of the data and the agency receiving the data by making certain that any questions about data use are discussed. Before any data are shared, both the provider and receiver should talk in person or on the phone to discuss data-sharing and data-use issues and come to a collaborative understanding that will then be documented in a data-sharing agreement. Data Sharing Agreement 2
- 3. Data Sharing Agreement ● Purpose o HIPAA and other laws require Covered Entities to obtain satisfactory assurance that the data recipient will only use or disclose the information for limited purposes to ensure that shared data will not be misused. • HIPAA (Health Insurance Portability and Accountability Act.) a US law designed to provide privacy standards to protect patients’ medical records and other health info. 3
- 4. ● Can the Data be shared and what type of agreement is needed? ● Steps o Can the data be shared? o Identify: o The data elements requested o De-identified o Limited Data Set o Identifiable Data o The applicable confidentiality laws Overview of Today’s Discussion 4
- 5. ● What type of written agreement is appropriate? Business Associate Agreement (BAA) Memorandum of Understanding (MOU) Data Sharing Agreement (DSA) You have determined that the data can legally be shared - 5
- 6. ●DSA is required by Law ●For liability reasons ●For ethical reasons WHEN / WHY IS DSA NEEDED? Monitoring ● Follow up is required – o After agreed time, at end of project, etc. o Ensure shared data continues to be protected or has been returned or destroyed 6
- 7. ● Step One: Identify the data elements requested: o De-Identified Data: is the removal of specific information about a patient that can be used alone or in combination with other information to identify that patient. o Limited Data Set o Identifiable Data Can the data be shared? Steps… 7
- 8. ● Two methods of de-identification o First: Safe Harbor – Ages, zip codes, or ‘dummy codes’ are permitted with limitations. o Age: In most cases, year of birth may be retained, however dates that might be directly related to the subject must be removed or aggregated to the level of year to prevent deduction of birth dates. Extreme ages – 90 and over – must be aggregated further to avoid identification of very old individuals. For young children or infants – age can be expressed in months, days, or hours – as long as the birth date can not be determined. De-identified Data 8
- 9. o Zip Code: Three digit zip codes can be used if the zip code area contains more than 20,000 people as determined by the Bureau of the Census. o ‘Dummy codes’: A re-identification code can be created and provided to the data recipient as long as the code was not derived from information related to the subject of the information. The mechanism used to create the code can not be disclosed to the data recipient. De-identified Data…cont. 9
- 10. ● Two methods of de-identification…continued o Second: Expert – a person with appropriate knowledge and experience is to apply generally accepted statistical and scientific methods to render information not individually identifiable. De-identified Data…cont. 10
- 11. ● A limited data set is a limited set of identifiable patient information as defined in the privacy regulations issued under HIPAA. ● All direct identifiers must be removed. Some demographic information, dates, and ‘dummy codes’, are permitted. Under HIPAA, a Limited Data Set can only be shared for the purpose of Research, Public Health, or Health Care Operations. o Demographic information is allowed, such as zip codes, cities, and geographic areas, however, street addresses are direct identifiers that must be removed. o All Dates are permitted – including birthdates, however, requests for birthdates should be reviewed for necessity. o ‘Dummy codes’: A re-identification code can be created and provided to the data recipient as long as the code was not derived from information related to the subject of the information. Limited Data Set 11
- 12. ● Data with identifiers may be shared if an exception exists under applicable law. o HIPAA permits the sharing of identifiable data for specific purposes – in which case, a Data Sharing Agreement may be warranted. Identifiable Data 12
- 13. ● Step Two: Identify the applicable confidentiality laws… more than one may apply o Medicaid: provide coverage for some low-income people, families and children, pregnant women, the elderly & ppl wit disability. o Public Health Code o Mental Health Code o HIV/AIDS/STD o Substance Abuse o HIPAA o Research – Human Subjects (Common Rule) o Other Can the data be shared? Steps…cont. 13
- 14. ● When more than one confidentiality law is applicable and both/all cannot be complied with… o The HIPAA Privacy regulation will preempt all other privacy or confidentiality laws, (state or otherwise) unless – the other law provides the individual with greater privacy rights or protections. Can the data be shared? Steps…cont. 14
- 15. ● Step Three: Identify the players – and the relationship between the data provider and the requester o Business Associate o Covered Entity (under HIPAA) o Public Health Agency o Researcher o Government entity o Independent o Other Can the data be shared? Steps…cont. ● After analyzing the requested data elements, all applicable laws, and the players – and their relationship, you have decided that the information can be shared… 15
- 16. ● What type of written agreement is appropriate? Business Associate Agreement (BAA) Memorandum of Understanding (MOU) Data Sharing Agreement (DSA) You have determined that the data can legally be shared - 16
- 17. ● Business Associate Agreement (BAA) o A business associate is an entity/contractor that requires the sharing of protected health information (PHI). ● Memorandum of Understanding (MOU) o A MOU is similar to a BAA, however, is generally used when sharing identifiable data between governmental entities to carry out responsibilities under state or federal law. What type of written agreement is appropriate? 17
- 18. ● Data Sharing Agreement (DSA) o A DSA may be required in the following circumstances: o If sharing de-identified information with any entity. o If sharing a limited data set or identifiable data with a business associate where a new function has been added under the contract. o If sharing a limited data set with a business associate that has requested the information for its own public health, research, or health care operations. (continued…) What type of written agreement is appropriate? 18
- 19. A DSA may be required in the following circumstances (continued): o If sharing a limited data set with a researcher. This eliminates the researcher’s need for an individual’s authorization. The researcher also might be able to bypass the Institutional Review Board (IRB: other law) review requirement for human subjects research. (Refer to Harry McGee.) (continued…) Data Sharing Agreement (DSA) (continued…) 19
- 20. A DSA may be required in the following circumstances (continued): o If sharing a limited data set with another covered entity that has requested the information for its own public health, research, or health care operations. (Assists in the sharing of data with another covered entity where HIPAA limits the sharing of fully identifiable information – e.g. “to another covered entity for its health care operations”.) o If sharing a limited data set with any other entity for public health or research purposes. (e.g., non MDCH cancer registry.) o If sharing fully identifiable information to an entity for a permitted purpose under HIPAA or other applicable confidentiality law. Data Sharing Agreement (DSA) (continued…) 20
- 21. ● Please forward a copy of all completed MDCH Data Sharing Agreements to the Office of Legal Affairs (OLA) to be entered into MDCH DSA Database. MDCH Log of Data Sharing Agreements 21
- 22. ● Identify the requested data elements, the applicable laws, and the players, ● Determine the appropriate agreement that is needed and execute, ● Send copy of completed MDCH DSA to OLA to be logged, ● Monitor – and follow up at end of project, or agreed upon time, to ensure shared data continues to be protected or has been returned or destroyed. In review: 22
- 23. ● What is DSA? ● State the importance of agreement in data sharing administration ● Cite the types of written agreement ● Why is DSA needed? ● Prepare data sharing policy and regulation (Hints: The 3 types) ● Outline the factors that can work against DSA (Hints: Conflict of interest, ethical consideration, lack of communication…) Questions? 23