How a Health Org Approaches EHR Data Governance, Clinical Research

Interdisciplinary data governance committees at UNC Health have helped steward the secure use of EHR data for clinical research, according to a study published in JAMIA.

As researchers look to leverage EHR data to fuel their studies, proper stewardship of the data is paramount for data security.

The Carolina Data Warehouse for Health (CDW-H) is the central repository for EHR data for UNC Health.

The data governance process at for CDW-H data aims to be compliant, efficient, and supportive of research, the study authors noted. This means that data requests are reviewed in a timely manner, align with the corresponding IRB protocol, and comply with institutional policy and federal law.

CDW-H officials approved 302 of 319 data requests received in 2020 (94 percent). Most requests (83 percent) were reviewed via administrative review, and 72 of these requests received approval in less than two weeks.

Fifty-seven requests (21.5 percent) required modification to the data request, IRB protocol, or both to be compliant and ensure alignment across the documents. The CDW-H Operations Committee reviewed 54 requests (16.9 percent) and approved about half of those requests within 2 months.

The researchers noted that the committee process is lengthier because requests tend to be complex and require multiple consultations.

“Most requests receive stipulations, which must be addressed before approval,” the study authors explained. “Common stipulations include modifications to ensure request and IRB protocol alignment or execution of a data sharing agreement.”

In some instances, the CDW-H Operations Committee can escalate requests to the CDW-H Oversight Committee. This committee reviewed three data access requests from 2020 and ultimately approved all three.

The primary goal of CDW-H governance is to determine how best to safely use EHR data for clinical research, the researchers noted. However, while HIPAA provides legal guardrails, CDW-H officials said that they have learned that questions about data sharing often go beyond what HIPAA considers.

“UNC’s interdisciplinary governance committees exist to address this exact challenge,” they explained.

Governance considers several factors beyond IRB requirements when approving the use of EHR data for clinical research.

First, governing bodies consider if the request is limited to the minimum necessary data.

“HIPAA requires only the minimum necessary information to complete a task to be disclosed; therefore, the Committee may require such requests be narrowed in scope, or the scope of the request be well justified,” the study authors wrote.

Additionally, governance considers if data sharing plans are justified and in compliance with legal requirements. As projects requiring data sharing outside the institution become more common, the committee must weigh the value of the data sharing with that risk.

“Key considerations include what data will be shared, what plans there are for data reuse, how shared data will be stored, and whether a data sharing agreement will be in place,” they noted.

Governance also takes into consideration what impact this data request could have on patients.

For instance, CDW-H data is frequently used to support recruitment for clinical trials. The committee recognizes that patients may have concerns if they receive a recruitment letter based on information in their medical records, so UNC created template recruitment language to help address this concern.

Lastly, CDW-H officials considers what impact data requests could have on the institution.

“A common concern when sharing EHR data is the possibility that data could be misused for competitive purposes,” the study authors explained.

For instance, a project that allows researchers to access data from multiple health systems could make it easier to compare rates of post-surgical complications among competing institutions. Therefore, the Committee may mandate that researchers do not include UNC’s name in the combined dataset.

“Our governance process has proven effective and efficient for UNC over the past decade,” the study authors wrote. “The Committees are a valuable resource for the University and Health System. They help ensure clinical data are provisioned appropriately and researchers are educated about the benefits and sensitivities of working with clinical data.”

“Though many data governance challenges lie ahead, our past experience demonstrates that this system is a robust one that is able to address a dynamic clinical research environment,” the researchers concluded.