Data Request, Use Requirements and Attestation

Introduction:

1. All data pull requests, including those submitted to RISE, will first submit their project using this intake form.  The intake form will automatically capture the required acknowledgments/data use attestations. 
2. All approved intake forms will be assigned a project number from OR
3. Once the project requester has the project number, the intake form will go to RISE to determine if this is a project they want to accept:
1. If so, RISE can proceed with the data pull from Sentara's portal (or other sources) with the assigned project number ;
2.  If not, RISE will reject the project and will be routed back to OR to determine if/when they can make a direct request through the portal.

Even though Single-Patient Case Studies do not require IRB approvals, please consider securing an official IRB determination NOW that your single-patient case study is "non-research".

This is quite easy to do. Here is why. If your case study progresses into a manuscript to be submitted to a journal that requires a case report to have official IRB review as "non-research".

At that time, it will not be possible for IRB to render the "non-research" determination to you study because IRB can't review a study retrospectively.

IRB Approval is required prior to submitting your request to Sentara or EVMS Medical Group! 

If you submit your request without approval, your request will be denied.

Sentara requires that trainees/students must be supervised by a faculty level researcher or an attending physician. This person should be an official team member of the IRB-approved study. Sentara will NOT entertain a data request by a team consisting of learners only (i.e., students, residents, and/or fellow).

If the request is for Sentara's EPIC data and the PI information is left blank, the request won't be allowed to move forward.

REQUIRED

Introduction/Background:
Personally identifiable Data("PID"), protected health information ("PHI"), or other sensitive information ("SI") (collectively, PID, PHI, and SI shall be known as the "Data") may be used by Centers, Departments, Project Leaders or Principal Investigators (PI) to perform services or to conduct research that has been approved by the Macon & Joan Brock Virginia Health Sciences at Old Dominion University ("VHS") Office of Research. In order to provide this use, Old Dominion University ("ODU") may enter into one or more agreements with the Data provider(s) that place responsibility on ODU to ensure that the Data is kept confidential and accessed only in a manner permitted by the Data Provider. As such, every individual that will have access to Data has an obligation to safeguard that Data as outlined herein.

Accessing and Using Data:

 
You may only access and use Data when it is necessary, appropriate, and lawful to do so in the performance of your duties. This means that:

1. 
   Data may only be used for the approved purpose (providing specific services requested by the Data provider or, in the case of research projects, for the project approved by the IRB and the Data Provider). Any deviations from such use must be specifically approved by the Data provider and/or the IRB (if applicable). Note that an approved IRB protocol does not automatically grant you the ability to search, access, identify, disclose, discuss, release or reuse Data for future projects, even if you have access to that Data for other purposes or you have been granted access to that Data in the past for another project.
2. 
   Data may not be accessed or used for personal reasons (to check on someone you know, at the request of someone else, out of curiosity, etc.).
3. 
   Data and/or access to Data may not be provided to any unauthorized person or entity (unauthorized means that the person or entity is not part of ODU and/or does not have a need to access the Data or purposes of this project), without the express written permission of the Data Provider. This also means that you may not share Data with a non-ODU co-investigator, until/unless such use is approved by the Data Provider.

Protecting Data:

To keep Data from unauthorized access or use, it must be protected at all times by using the following measures. 

Security:

1)      Data in hard copy must be stored in locked drawers or cabinets. 

2)      Computer workstations, laptops, and mobile devices must be locked when not in use and must utilize screen security (alpha-numeric or fingerprint enabled). 

3)   You must log out of software or other applications that collect or maintain Data when you leave a workstation.  

4)      CDs, USB flash drives, and other mobile device storage may not be used to store any PID, PHI, or SI without explicit permission from the Data Provider and, if approved, they must utilize encryption/password protection. 

5)      All workstations, laptops or other computing devices and laptops that will be used to access Data (whether owned personally or by ODU) must be maintained in accordance with ODU Technology Services (IT) standards, including but not limited to, up-to-date virus protection.

6)    ODU electronic systems may only be accessed with the credentials (User ID and password) assigned specifically to you by ODU IT.  Credentials may not be shared, disclosed, or publicly posted, and you will be held responsible for any unauthorized access that results if your credentials are shared.

7)        You may not use any cloud services for Data unless it is outlined in the project protocol.

8)     ODU network accounts (ending in "@odu.edu" or "@CONRAD.org") must be used for all communications.  Use of  personal email service (Gmail, yahoo, AOL, etc.) is not permitted.  Further, emails with Data may not be manually or automatically forwarded to a non-ODU personal email service and you may not use any "pop" protocol to force your ODU account email into a non-ODU personal account.

9)    You may not use any tool or techniques to break, exploit, or otherwise circumvent established security measures.

10)    All Data in electronic form must be removed from your computer, laptop, or other electronic device at the time such device is retired and/or before the device can be transferred to another area or department.

11)    Data and/or devices containing Data may never be thrown in standard trash bins.   Data in hard copy must be destroyed by shredding or other method that renders the Data unreadable and unable to be reconstructed.  Electronic Data must be cleared using software or hardware products that overwrite/delete the data.  It is your responsibility to know whether the Data you receive must be destroyed or returned to the Data provider at the end of the services or research project. 

Protecting Data:

Privacy:

1)      Data must be kept in strict confidence regardless of whether it is communicated to you in hard copy, faxed, electronically transmitted, via oral conversations, or in printed or other formats.   This confidence must be kept when performing your duties, as well as during breaks, rest periods, and time away from ODU. 

2)      You are responsible for ensuring that discussions concerning Data do not occur in hallways, elevators, or other public areas where someone not authorized to receive the Data could inadvertently overhear PID, PHI, or SI. 

3)      You may not share, release, or broadcast Data in any manner, including the posting of PID, PHI, or SI on any listserv or professional or social media site.

4)      If the Data provided is de-identified or a limited data set, you may not request PHI, or a link to PHI, from the Data provider or make any attempt to identify the information contained in the Data or contact the individuals whose information may be contained in the Data.

5)      Upon termination of your employment, expiration of your contract or other termination of your relationship with ODU, you will immediately return the Data or other related confidential information to EVMS.

Compliance:

1)      You are responsible for notifying  the applicable Center Director, Project Leader or PI , as applicable, and the VHS Research Privacy, wileyjp@odu.edu, 757-446-6008  immediately if:

a)      Your credentials used to access Data have, or may have been hacked, disclosed, or otherwise compromised;

b)      You  know or suspect that Data you have been provided was inappropriately accessed, disclosed, shared, hacked or otherwise compromised; 

c)      You misplace or otherwise lose possession of any notebook, device (computer, laptop, mobile device, mobile storage) that contains Data;

d)      You overhear, discover, or become aware of any Data that is not being protected as set forth herein.

2)      ODU reserves the right  to audit your work environment, computers, or other areas and devices that are used to access/use the Data at any time in order to ensure compliance with the requirements outlined herein.    

3)      The compliance obligations outlined continue indefinitely, even after termination or expiration of your employment, contract, or other relationship with ODU, and even if you no longer have the Data in your possession (e.g., you may not discuss the information).

4)      Any non-compliance and/or request or instruction to ignore or bypass the requirements set forth in this document must be reported to the VHS Research Privacy Official, 757.446-6008, wileyjp@odu.edu immediately.  You may also report through the Macon & Joan Brock Virginia Health Sciences Ethics and Compliance Hotline, https://app.convercent.com/en-us/LandingPage/683edfd1-4bee-e611-80d9-000d3ab1117e.   

5)      General questions about data compliance or compliance with the terms outlined herein should be directed to Josephine Wiley, Associate Vice President of Compliance and Legal Services, Macon & Joan Brock Virginia Health Sciences at Old Dominion University, wileyjp@odu.edu,  757-446-6008

Please read and acknowledge these requirements (1- 8)
(Warning: any deviation will result in significant delays in Sentara's processing of your requests)

1. All data requests made by VHS Faculty, Staff or Students must be submitted using the Sentara Health Research Center's portal and coordinated by the VHS Office of Research.
2. Questions regarding the proper method for requesting data from Sentara can be addressed to the VHS Office of Research at VHSresearch@VHS.edu.
3. IRB approval does not confer Sentara approval; all proposals will be reviewed to ensure compliance with Sentara policies and guidelines.
4. An active IRB approval is required for Sentara to allow use or disclosure of data for a formal research analysis. The approved protocol should include each member of the research team and an approved IRB addendum is required if additional research personnel are added or the project is amended.
5. All students and residents must have a faculty supervisor who will have ultimate responsibility for ensuring the proper conduct of the proposed research.
6. The HIPAA Privacy Rule requires that use or disclosure of data will be limited to the amount of data that is "minimally necessary" to answer the study question and accomplish the study aims. Thus, the number of participants in the cohort should be estimated using a statistical power calculation that is included in the study protocol. The participants should then be defined in the data request by the inclusion/exclusion criteria and the date ranges of study. Also, requested study variables should be justified by the study's methods and aims. A data collection tool in the form of an Excel spreadsheet should be included with each data request.
7. Requests should include clear definitions for each Epic variable. Epic variables must be specific (i.e., all medications of interest must be listed by name, all procedures and/or diagnoses of interest must be specified and codes included, any calculated variables must include how the variable will be calculated and what Epic variables are required to calculate the variable of interest). Where possible, researchers should note how the data are documented in the Epic record.
8. Requests must include a detailed plan for data transfer, data security, and data destruction following HIPAA guidelines.

Please Download and complete this Sentara Research Data Attestation Statement prior to accessing the Sentara Portal.

You will need to upload the completed form there.  You will receive an email from the REDCap system which includes the Office of Research Request ID Number requested on the form.