This page houses the data governance policies and procedures developed by the NACHC data governance council. These policies and procedures can be applied to activities where data is involved but are primarily focused on data sharing that is defined as 1) NACHC receiving data from an external organization, or 2) NACHC sharing data with an external organization.
...
The GC meets monthly and includes members who represent 1) NACHC leadership, regulatory, and analytic staff, and 2) external data partners and project partners who represent a range of perspectives and collective expertise in clinical care, informatics, data science, and population health. Details of the GC membership, scope, and operations are defined in a charter.
Project Structure
NACHC organizes and tracks data sharing within projects. Most projects use Confluence to manage information and safely share data through a Confluence website which defines the project team, provides links to relevant project documentation and agreements, location of project data, and tracks project progress. Projects have regular status meetings. Minutes and meeting materials from status meetings are made available on Confluence. At the start of each project, a project team is identified and includes members of the data partner organization(s) and NACHC staff and documented on the project Confluence page. Additionally, members of the project team who will have access to project data are identified at the project inception. As the project team evolves through the project lifecycle, the project team is updated on Confluence and in project-related documentation, as appropriate.
Project Roles and Terminology
NACHC conducts data sharing with data partners and project partners.
A data partner is the organization sharing data with NACHC which can include federally qualified health centers (FQHCs), primary care associations (PCAs), or health center-controlled networks (HCCNs). FQHCs are data owners in that they own the data collected by their organization. PCAs and HCCNs do not collect clinical data but serve as a data steward for clinical data provided by their members and contribute data on behalf of their member organizations. Federal agencies such as the Health Resources and Services Administration may also be data partners, providing UDS data to NACHC on behalf of FQHCs (example: UDS data).
A project partner is an organization who participates in or supports projects with data sharing by providing subject matter expertise, funding, vendor services, or other technical assistance. The CDC and HRSA are to common project partners. Project partners may perform project-related analyses or create project related data products (i.e., manuscripts, abstracts, or reports) which can require direct access to project data.
Every project is different. Depending on the scope of the project, a project may have one or multiple datasets from one or more data partners. For each project, the project data is defined as the data that will be shared by data partners with NACHC. Based on the project data, the analytic results that will be derived from project data and data products are also defined. Generally, analytic results and data products are either generated by NACHC or project partners.
An example figure illustrating the flow of data in a project with two data partners is shown below.
Services
Projects involving data sharing can also include the following informatics and analytic services: subject matter expertise, technical assistance, data management, and analysis services, which are defined in the table below. Most projects involve multiple services.
...
- Providing guidance materials and sharing knowledge with data partners on how best to collect, store, and use their data
- Sharing best practices from the field
- Creating and sharing tools for a specific use case
- Identifying translatable resources
...
- Coaching and assisting data partners to improve the quality of their data collection and use
- Providing educational programming to cultivate knowledge and build capacity with partners
- Coaching external and internal requestors in refining analytic requests to be more actionable and purpose driven
- Improving the use and quality of analytic planning and documentation
...
- Receiving, normalizing, and transforming data from partners into a format and structure aligned with analytic goals
- Mapping and normalizing disparate data structures and formats into a common data model
- Conducting data quality activities and identifying data quality issues
- Performing analysis on one or multiple datasets to assess a prescribed outcome or outcomes (e.g., the percent of women who received contraception counseling)
- Calculate a quality measure (e.g., the percent of screening-eligible patients who were screened)
*Technical Assistance and Analysis can involve the support of contractors or other project partners. AT Still University is frequently used for advanced statistical methods.
Section 2: Data
NACHC uses data either shared with NACHC by a data partner or collected by NACHC. When NACHC has received data from a data partner, NACHC acts as a data steward. Data stewardship is the collection of practices that ensure an organization’s data is accessible, usable, safe, and trusted.
Data Shared with NACHC
There are many types of data that may be shared with NACHC including UDS data, clinical data, and membership or other health center data.
UDS Data
NACHC receives UDS data from HRSA that includes health-center level information on a variety of topics including services, staff, capacity, and financial data so that NACHC can perform analyses on behalf of HRSA and FQHCs to describe the health center landscape and services. The UDS data that NACHC receives includes some data that is available publicly and some sensitive data that only NACHC holds. UDS data does not contain PHI but is sensitive. Sharing UDS data with NACHC occurs under a cooperative agreement with HRSA which is overseen by the Director of Knowledge Management and Learning (Currently Margaret Davis). The parameters of UDS data sharing and use are defined in two HRSA agreements (Authorization letter, NACHC DUA). Included in these documents are explicit directions about how findings from the UDS data should be communicated in a way that protects the identity of health centers and their patients.
The UDS data is stored securely at NACHC. Only NACHC staff who have signed the NACHC DUA are permitted to access and use the UDS data. Once a DUA has been executed with an individual and access granted to the UDS datasets, all uses of UDS data must be approved by the UDS Program Director.
Clinical Data
NACHC receives clinical data primarily extracted from EHRs at the patient level. These clinical data are subject to HIPAA privacy and security regulations and can fall into the below categories.
De-identified data is data that has been “stripped of all HIPAA defined identifiers” which includes Personally Identifiable Information (PII) and Protected Health Information (PHI). PII is a subset of PHI and the list of 18 data elements that are considered PHI are documented in the HIPAA Safe Harbor definition. "Safe Harbor" is the deidentified method that NACHC uses which means that to be considered de-identified, all 18 identifiers must be completely removed from a dataset. Any dataset with a zip code or full dates is not de-identified.
A limited data set (LDS) includes data that has been stripped of all 18 HIPAA identifiers, except age, full dates, and five digit zip code, as identified by HIPAA Safe Harbor guidelines.
Identified data sets which include PHI beyond that which would qualify as an LDS and are not accepted by NACHC at this time.
Survey Data (EK to talk to Kathy, Margaret Davis, someone from PPR, Meg Meador, Michelle Proser)
For some projects, NACHC collects its own data, usually in the form of surveys that are completed by health centers or member information. These surveys will be anonymous and do not collect patient identifiers if received or held directly by NACHC.
What are the kinds of survey data. What are the tools. How governance applies to it.
...
Project Roles and Terminology
NACHC conducts data sharing with data partners and project partners.
A data partner is the organization sharing data with NACHC which can include federally qualified health centers (FQHCs), primary care associations (PCAs), or health center-controlled networks (HCCNs). FQHCs are data owners in that they own the data collected by their organization. PCAs and HCCNs do not collect clinical data but serve as a data steward for clinical data provided by their members and contribute data on behalf of their member organizations. Federal agencies such as the Health Resources and Services Administration may also be data partners, providing UDS data to NACHC on behalf of FQHCs (example: UDS data).
A project partner is an organization who participates in or supports projects with data sharing by providing subject matter expertise, funding, vendor services, or other technical assistance. The CDC and HRSA are to common project partners. Project partners may perform project-related analyses or create project related data products (i.e., manuscripts, abstracts, or reports) which can require direct access to project data.
Every project is different. Depending on the scope of the project, a project may have one or multiple datasets from one or more data partners. For each project, the project data is defined as the data that will be shared by data partners with NACHC. Based on the project data, the analytic results that will be derived from project data and data products are also defined. Generally, analytic results and data products are either generated by NACHC or project partners.
An example figure illustrating the flow of data in a project with two data partners is shown below.
Services
Projects involving data sharing can also include the following informatics and analytic services: subject matter expertise, technical assistance, data management, and analysis services, which are defined in the table below. Most projects involve multiple services.
| Subject matter expertise | Technical assistance* | Data management | Analysis services* |
|---|---|---|---|
|
|
|
|
*Technical Assistance and Analysis can involve the support of contractors or other project partners. AT Still University is frequently used for advanced statistical methods.
Section 2: Data
NACHC uses data either shared with NACHC by a data partner or collected by NACHC. When NACHC has received data from a data partner, NACHC acts as a data steward. Data stewardship is the collection of practices that ensure an organization’s data is accessible, usable, safe, and trusted.
Data Shared with NACHC
There are many types of data that may be shared with NACHC including UDS data, clinical data, and membership or other health center data.
UDS Data
NACHC receives UDS data from HRSA that includes health-center level information on a variety of topics including services, staff, capacity, and financial data so that NACHC can perform analyses on behalf of HRSA and FQHCs to describe the health center landscape and services. The UDS data that NACHC receives includes some data that is available publicly and some sensitive data that only NACHC holds. UDS data does not contain PHI but is sensitive. Sharing UDS data with NACHC occurs under a cooperative agreement with HRSA which is overseen by the Director of Knowledge Management and Learning (Currently Margaret Davis). The parameters of UDS data sharing and use are defined in two HRSA agreements (Authorization letter, NACHC DUA). Included in these documents are explicit directions about how findings from the UDS data should be communicated in a way that protects the identity of health centers and their patients.
The UDS data is stored securely at NACHC. Only NACHC staff who have signed the NACHC DUA are permitted to access and use the UDS data. Once a DUA has been executed with an individual and access granted to the UDS datasets, all uses of UDS data must be approved by the UDS Program Director.
Clinical Data
NACHC receives clinical data primarily extracted from EHRs at the patient level. These clinical data are subject to HIPAA privacy and security regulations and can fall into the below categories.
De-identified data is data that has been “stripped of all HIPAA defined identifiers” which includes Personally Identifiable Information (PII) and Protected Health Information (PHI). PII is a subset of PHI and the list of 18 data elements that are considered PHI are documented in the HIPAA Safe Harbor definition. "Safe Harbor" is the deidentified method that NACHC uses which means that to be considered de-identified, all 18 identifiers must be completely removed from a dataset. Any dataset with a zip code or full dates is not de-identified.
A limited data set (LDS) includes data that has been stripped of all 18 HIPAA identifiers, except age, full dates, and five digit zip code, as identified by HIPAA Safe Harbor guidelines.
Identified data sets which include PHI beyond that which would qualify as an LDS and are not accepted by NACHC at this time.
Assessment Data (EK to talk to Kathy, Margaret Davis, someone from PPR, Meg Meador, Michelle Proser)
NACHC collects data through assessments of health centers, primary care associations, patients, and other stakeholders.
Health Center Assessments: Some health center assessments are anonymous while others identify the health center or even the individual within the health center completing the assessment. Some assessments are recurring while others are ad hoc. One example is the rapid response assessment of health centers, a quarterly assessment of health center leadership which includes a mix of qualitative and quantitative data collection such that the resulting assessment data is a mix of structured and unstructured. This assessment like many assessments of health centers results in a summary report that presents high level findings and does not identify health centers. High level findings may include state estimates. If stakeholders request health center level findings, NACHC will get written approval from the health centers before releasing health center level results.
Patient Assessment: NACHC does not often assess patients directly but when they do, no identifiers are collected. Need more info here.
Meeting Evaluation Assessment: Another use of assessments is for meeting evaluation for which the audience could be mixed and no identifiers are collected.
NACHC uses Qualtrics or Survey Monkey to conduct assessments.
Other Data
Outside of UDS, clinical data, and survey data, NACHC receives data from health center members and financial data. Over time, these other data sources will be incorporated into the broader NACHC data governance portfolio.
Requests for Data
NACHC receives requests for data that are either apart a part of a new or existing project. For clinical and UDS data, NACHC uses a central request process, referred to as a front door, to receive, review, and make determinations on requests from external organizations. Front Door instructions are available here. NACHC will only approve requests that benefit health centers and align with the NACHC vision.
...
When underlying data are biased, NACHC recognizes the risk that resulting models or analytic results may also be biased. NACHC prioritizes using datasets that have a representative amount of data from each group and annotating products accordingly to call attention to this important issue.
Identification of Health Centers in Work Products
In general, NACHC does not identify health centers in work products. There are some projects where identification of health centers is appropriate. When health centers need to be identified, NACHC solicits written approval to do so and engages health centers in a thorough review process.
For some work products that present health center level findings, there could be a risk to health centers to be re-identified by other means, especially with maps or health centers that see special populations. NACHC mitigates this concern with intentional and thorough review as well as small cell suppression.
Section 5: Data Security and Privacy
...
Federal regulations require that research projects involving human subjects be reviewed by an Institutional Review Board (IRB). According to the FDA, an IRB is an appropriately constituted group that has been formally designated to review and monitor biomedical research involving human subjects. The IRB must approve or determine the project to be exempt or approved prior to the start of any research activities. The IRB cannot provide approval or determinations for research that has already been concluded.
...
The federal regulations define both "research" and "human subject." Research is defined as a systematic investigation, including research development, testing, and evaluation, designed to develop or contribute to generalizable knowledge.Studies must be reviewed by an Institutional Review Board (IRB) only if both definitions apply. A project may involve data from human subjects, but not meet the definition of research and would, therefore, not require an IRB review. Research is defined by federal regulations at 45 CFR 46.102 (Protection of Human Subjects 2009), as "a systematic investigation including research development, testing, and evaluation, designed to develop or contribute to generalizable knowledge."
...