Data governance policies and procedures to inform data-related activities were developed by the NACHC Clinical Affairs team in partnership with other NACHC teams and external partners. These policies and procedures can be applied to any activities where data of any kind is received, collected, or generated, referred to as 'informatics work' hereinafter.
...
Our data governance framework focuses on how NACHC uses processesprocess, policies, procedurespolicy, and effective communication tools that to ensure that data received from outside organizations and collected by NACHC is are used to improve the health of individual patients and tell the health center story.
...
Section 2: Contracts and Regulatory
Contracts
At NACHC,
HIPAA
According to HIPAA, NACHC is not a covered entity. However, NACHC acts as a business associate of covered entities in their receipt and analysis of protected health informationreceives limited and deidentified datasets from covered entities. Though the amount of PHI received by NACHC is minimal, NACHC treats all of its data from covered entities as PHI and as such, complies with the expectations of business associates as outlined by HIPAA.
...
- NACHC project lead completes the NACHC DUA Checklist to determine if a DUA is needed. This should occur as part of the project's initiation.
- The checklist is reviewed with data partner at an early project meeting to confirm the need for a DUA and level of identification of a dataset
- Once completed, the DUA checklist is stored in the project Confluence page.
- If the DUA checklist identified a need for a DUA, the checklist is shared with the NACHC contract officer to begin the creation of a project-specific DUA.
Section 3: Requests
NACHC receives many requests for data that has already been shared with them for an existing project or a request for data related to a new project. Additionally, NACHC receives requests for information partnership meaning a desire from one organization to work with a health center and a desire for NACHC to support that partnership.
All requests for data or information partnerships that include data sharing are evaluated by the data governance council which meets monthly. Requests must be well defined meaning that they include a clear description of what data is desired, how the data will be used, the type of use (e.g., research, surveillance, quality improvement or other) and how the request aligns with the NACHC vision and benefits health centers. Incomplete requests that do not include this information cannot be evaluated and will be returned to the requester. Requesters will be notified of an approval or denial within one week of the data governance council meeting.
...