| Please provide any feedback regarding this scenario in the comment form below or by clicking here. |
|---|
Max Researcher at Advanced Research Institute receives IRB approval to conduct PCOR on labor and delivery procedures. She plans to use several administrative claims databases from private insurers that provide care to patients in multiple states; however, a well-recognized limitation of claims databases is their lack of gestational information (e.g., gestational age, location of birth) critical for prenatal and pregnancy-related research. Therefore, Max would like to combine information from claims databases owned by insurers with birth certificate records held by individual states.
Max does not plan to collect any clinical data or contact patients directly and obtains waivers of authorization from her IRB. Once the data is obtained, Max Researcher combines all data sets by linking them with a unique identifier generated specifically for (and unique to) the study and de-identifies the data in compliance with HIPAA Safe Harbor Criteria. Max Researcher’s research facility holds the data locally. Max is the only data recipient to whom the data can be disclosed. Max must destroy the data two years after the end of the active collection phase, as specified in the DUA. Max may not reuse the data or connect them with a different study.
There are several known barriers that must be overcome to enable these linkages:
First, certain states will only grant access to birth certificate data for one study at a time. If Max Researcher wants to conduct another study, he will have to repeat the same IRB approval process again.
Second, certain states will only let their Departments of Health staff perform record linkages, introducing significant delay. Some insurers that manage claims databases are not willing to share identifiable information with the states for such purposes.
Finally, certain states will only allow linkages to be performed by Max or his team members, but only at their Department of Health's facilities, also introducing delays.
Questions:
- Besides those mentioned above, what other variations in state laws may produce barriers to data acquisition? Burdens on researchers that might delay or disincentivize potentially valuable research?
- Do record linkages that must be conducted by state health departments put patient privacy/data security at risk? What are the variations in privacy/security protections required state-to-state? Are there with conducting research in this case?
- What, if anything, can be done to provide assurances to insurers managing claims databases about risks of sharing identifiable information?
| |
Description | Max Researcher will combine data sets stored by multiple administrative claims databases (held by insurers) with birth records (held by multiple states). |
Primary actor/participant | Researcher (end-user) using Research Info System |
Support actor/participant | Insurers, state health departments |
Pre-conditions | Research organization, insurers, and state health departments use standard-based interoperability to exchange information in a secure environment. Researcher has approval from IRB to request data for a list of enrolled participants. Research unique identifiers are used to request data to protect the identity of patients so there is a low risk of re-identification. All sites have executed a DUA authorizing the Researcher’s organization and its approved representatives to request and receive a minimum data set and use the data set for a research study. |
Post-conditions | Researcher has access to data set and is able to analyze/combine them for a specific research study. |
Alternatives | Creating linkages between All Payer Claims Databases (APCDs), health information exchanges (HIEs), and other forums DUA or study expired, the Researcher does not have access to the data anymore. Information was sent electronically from data site to the Research Information System that combines the data sets. |
Considerations | Researchers must access multiple, separate portals to obtain data to be linked. |
Data Elements Considered | Electronic data from multiple sites |
Purpose of the Data Collection | Administrative purposes, Public health surveillance |
Purpose of Data Use | Analysis under a specific research protocol |
Terms of Transfer to the Data Holders | Usual care, notice of privacy practices |
Terms of Transfer to Researchers | IRB approval |
