Reminder: Do not include any PHI or PII in Confluence. If you require 508 accessibility assistance or any other support for this system, then please send an email to onc-jira-questions@healthit.gov
Max Researcher is conducting an NIH-funded study regarding how exercise and the environment are associated with asthma control. The IRB approved protocol involves recruiting participants using an iPhone application that can be downloaded by anyone with an iPhone interested in participating. Upon installing the application, participants are asked to install a tracking application on their iPhone that regularly sends data from third party activity trackers (e.g., FitBit) to a research database where the activity data can be merged with data from the participants’ electronic health records. There are no advance agreements between the research team and providers.
Using the application, participants complete an electronic consent form and agree to be contacted for research purposes. Participants have the option to complete HIPAA authorization for release of electronic medical records for the research project, which participants can send to healthcare providers directly so that the research team can manage data requests. The application also includes a secure email messaging system that allows participants to request electronic copies of their medical records from their physicians so that they may relay the records to the research information system. Providers that do not have Patient-facing Personal Health Records incorporated into their EHRs receiving the authorizations and request messages are unsure of how to verify that the requests are truly coming from their patients.
Questions:
- What is the best system to verify the identity of the research participant in the EHR and iPhone application?
- Are there different considerations for different options for patients to enable transfer of data from providers to researchers?
- Alternatives include working directly with healthcare providers to initiate contact with patients to ensure identities are managed reliably, what are the implications of this topology for the third-party applications and researchers?
- More generally, is “access to research” a right that should be protected? Is it ethical to limit access to iPhone users, or to patients that are served in healthcare systems with pro-active research programs?
Title | Response |
Description | Transferring data from electronic medical records to be merged with Patient Generated Health Data in research databases. |
Primary actor/participant | Researcher, Providers, & Participants, third party activity tracking services for PGHD |
Support actor/participant | EHR Vendors |
Preconditions |
|
Postconditions |
|
Data Elements Considered | Activity tracking and geocoded data, complete EHR records |
Purpose of the Data Collection | Research, healthcare |
Purpose of Data Use | Understanding Asthma Risk Factors |
Terms of Transfer to the source data holders | Healthcare, terms of PGHD use, informed consent |
Terms of Transfer to Researchers | IRB approval, informed consent |