This page houses the data governance policies and procedures developed by the NACHC data governance council. These policies and procedures can be applied to activities where data is involved but are primarily focused on data sharing that is defined as 1) NACHC receiving data from an external organization, or 2) NACHC sharing data with an external organization.
...
Section 1: Governance Approach
Amy Flowers (Unlicensed) Lets add the definitions here.
Data Governance Decision-Making
...
NACHC uses data either shared with NACHC by a data partner or collected by NACHC. When NACHC has received data from a data partner, NACHC acts as a data steward. Data stewardship is the collection of practices that ensure an organization’s data is accessible, usable, safe, and trusted.
Data Shared with NACHC
There are many types of data that may be shared with NACHC including UDS data, clinical data, and membership or other health center data.
...
Outside of UDS, clinical data, and survey data, NACHC receives data from health center members and financial data. Over time, these other data sources will be incorporated into the broader NACHC data governance portfolio.
Requests for Data
NACHC receives requests for data that are either a part of a new or existing project. For clinical and UDS data, NACHC uses a central request process, referred to as a front door, to receive, review, and make determinations on requests from external organizations. Front Door instructions are available here. NACHC will only approve requests that benefit health centers and align with the NACHC vision.
...
Data Use Agreements (DUAs)
A Data Use Agreement (DUA) is an agreement that governs the sharing of data between research collaborators who are covered entities under the HIPAA privacy rule. A DUA establishes the ways in which the information in a limited data set may be used by the intended recipient, and how it is protected. NACHC requires the execution of a data use agreement (DUA) whenever dataset is being shared with or by NACHC. For projects where a LDS is being shared, a DUA is required by HIPAA. For projects where deidentified dataset is being shared, a DUA is executed based on NACHC policy. NACHC observes the HIPAA Privacy Rule standards for a DUA. The purposes of a DUA are to:
...
Data often results in work products which may include data quality results, analytic results, value sets, measure definitions, abstracts, presentations, manuscripts, and reports.
Research
Amy Flowers (Unlicensed) lets work on this.
Quality Improvement
From quality improvement projects, work products Work products can include a project dataset, that could be shared or retained with other project partners, depending on the restrictions. Specifically, data from clinical sources that are bound by data use agreements may be restricted by those agreements in their ability to be shared with other parties. Further, data use agreements can require that clinical data are destroyed after the agreement expires or when the project concludes.
Ownership and Attribution
Ownership and attribution of work products is project dependent. From quality improvement projects that use data from health health centers, work products are collectively owned by NACHC, the data partners who contributed data to the work product, and other project partners that supported the project. Once approved by all parties, these products may be used and disseminated widely so that many may benefit from what was learned. For research projects, data that is collected by NACHC is generally owned by NACHC.
Attribution
Historically, patients and health centers have not always been recognized for their contribution to work products. NACHC believes appropriate attribution of work products that recognizes health center contributions to NACHC work is essential to their mission. How and to whom work products are attributed is discussed with all project partners at the outset and as the project evolves to ensure that attribution of work projects is accurate and equitable.
NACHC recommends that each project define work products and discuss ownership and attribution of work projects is accurate and equitable.
Review
...
with all project stakeholders early in the project planning process.
Review
For some work products, engaging a wider group of organizations in review before publication is appropriate.
When health center data has been used for a quality improvement project, NACHC guarantees health centers the right to review work products resulting from projects that they participated on before those work products are finalized or publicly disseminated. Depending on the nature of the work product, health center review may be structure as opt-out or a required approval of work products.
Health Equity in Work Products
...
When underlying data are biased, NACHC recognizes the risk that resulting models or analytic results may also be biased. NACHC prioritizes using datasets that have a representative amount of data from each group and annotating products accordingly to call attention to this important issue.
Identification of Health Centers in Work Products
In general, NACHC does not identify health centers in work products. There are some projects where identification of health centers is appropriate. When health centers need to be identified, NACHC solicits written approval to do so and engages health centers in a thorough review process.
For some work products that present health center level findings, there could be a risk to health centers to be re-identified by other means, especially with maps or health centers that see special populations. NACHC mitigates this concern with intentional and thorough review as well as small cell suppression.
Section 5: Data Security and Privacy
...
Federal regulations require that research projects involving human subjects be reviewed by an Institutional Review Board (IRB). According to the FDA, an IRB is an appropriately constituted group that has been formally designated to review and monitor biomedical research involving human subjects. The IRB must approve or determine the project to be exempt or approved prior to the start of any research activities. The IRB cannot provide approval or determinations for research that has already been concluded.
...
The federal regulations define both "research" and "human subject." Research is defined as a systematic investigation, including research development, testing, and evaluation, designed to develop or contribute to generalizable knowledge.Studies must be reviewed by an Institutional Review Board (IRB) only if both definitions apply. A project may involve data from human subjects, but not meet the definition of research and would, therefore, not require an IRB review. Research is defined by federal regulations at 45 CFR 46.102 (Protection of Human Subjects 2009), as "a systematic investigation including research development, testing, and evaluation, designed to develop or contribute to generalizable knowledge."
...
Research data are stored securely in a project specific location (i.e., SharePoint) and transmitted using secure methods (e.g., SFTP, Dropbox). Only the research team has access to the research data for a given project. Transmission methods are determined based on the preferences of the PI and the project partners. Research project produce data products which are de-identified and shared with project team and relevant stakeholders outside of NACHC through Confluence.
Section 7
...
: Definitions
For the purpose of discussing data governance, NACHC observes the following definitions.
Research:
Quality Improvement:
Evaluation:
Add definitions of research, quality improvement, evaluation.