Development of a privacy and security policy framework for a multistate comparative effectiveness research network

Area of Science:

• Health Services Research
• Health Informatics
• Public Health Policy

Background:

• Comparative effectiveness research (CER) in distributed research networks (DRNs) faces challenges due to varying state laws and institutional policies on health information privacy and security.
• Existing regulations can impede the timely execution of CER studies.

Purpose of the Study:

• To develop and demonstrate a scalable, flexible technical infrastructure for DRNs to enable near real-time CER.
• To ensure CER activities are consistent with privacy and security laws and best practices.

Main Methods:

• Analysis of privacy and security laws and state health information exchange (HIE) guidelines for SCANNER participants (California, Illinois, Massachusetts, Federal Veteran's Administration).
• Expert panel review and input on the policy framework through 5 meetings (2011-2012).
• Application of guidelines to 3 CER use cases: hematologic medications, diabetes/hypertension management, and acute respiratory infections interventions.

Main Results:

• A flexible, use-case driven policy framework was developed, accommodating variations in data types (aggregate, deidentified, limited, identified) and data flow.
• Network-level and data use agreements were identified as necessary components for DRNs.
• The framework emphasizes balancing policy flexibility with data stewardship responsibilities.

Conclusions:

• The developed policy framework offers a scalable and adaptable approach for conducting CER in DRNs.
• Flexibility in policies is essential to accommodate diverse data types and research needs while maintaining robust privacy and security.
• Effective data stewardship requires careful consideration of legal, regulatory, and ethical requirements in DRN operations.