3 ms·

Why should study data subject to higher security standards than information that is collected on the patient during the process of providing care that is much m

by harryh 9y ago

Why should study data subject to higher security standards than information that is collected on the patient during the process of providing care that is much more sensitive?

mbreese 9y ago
All PHI is subject to the same data security standards, regardless of if it is from research or clinical sources.
- harryh 9y ago
  That's not what the blog post linked here says.
  - mbreese 9y ago
    I didn't see anyplace in the blog post where they say how the data in the chart (that they couldn't use) was stored. Did I miss that part? Are we talking about the online chart that they used? Just because they couldn't use the online (clinical) chart to store research data doesn't mean that the data that backs the clinical chart application is stored in any less secure way. There are very specific methods that are used to store PHI electronically. The fact that the clinicians (who needed access) could access it doesn't mean it wasn't stored securely -- they were supposed to have access to it. In all clinical research there is a clear separation between clinical (as in, used for treatment) and research (as in, should never be used for treatment) data. When you try to hit that gray in-between area is when you start to have issues with IRBs. In particular, when you are both the treating physician and the researcher, you have to be particularly careful about keeping the two sides separate. There is no way anyone should be allowed to store research data in the clinical record -- even if the researchers otherwise have access to the clinical chart. Also -- it should be mentioned that not all study data is automatically PHI. In fact, most of it shouldn't be. Once it's been de-identified, then the data isn't PHI any more and can be more freely used for research. This is why there is so much emphasis on the security for storing the "unblinding" documentation.
mjevans 9y ago
Mostly in preparation for sharing the study data with others (E.G. Publishing, outside data processing). It's just good hygiene to have the non-sensitive data isolated from the sensitive stuff. Identifying information belongs under lock and key, or at least forcing a user to authenticate again (even if by literal physical key-fob/ID card) (and should for the hospital too). Answers to questions which can't be classified as the above can be associated with a fully synthetic ID that works as a pointer to the above. That makes them less sensitive (but still important to keep secure: E.G. they could be in the office which is always locked when un-occupied and don't have to be stored in the safe). Practicing this discipline also makes it less likely for researchers and writers to inadvertently leak patient data. I'm actually shocked at how often hospitals / clinics / etc don't practice similar division of data by storage requirement.

by harryh 9y ago

Why should study data subject to higher security standards than information that is collected on the patient during the process of providing care that is much more sensitive?

mbreese 9y ago

All PHI is subject to the same data security standards, regardless of if it is from research or clinical sources.

harryh 9y ago
That's not what the blog post linked here says.
- mbreese 9y ago
  I didn't see anyplace in the blog post where they say how the data in the chart (that they couldn't use) was stored. Did I miss that part? Are we talking about the online chart that they used? Just because they couldn't use the online (clinical) chart to store research data doesn't mean that the data that backs the clinical chart application is stored in any less secure way. There are very specific methods that are used to store PHI electronically. The fact that the clinicians (who needed access) could access it doesn't mean it wasn't stored securely -- they were supposed to have access to it. In all clinical research there is a clear separation between clinical (as in, used for treatment) and research (as in, should never be used for treatment) data. When you try to hit that gray in-between area is when you start to have issues with IRBs. In particular, when you are both the treating physician and the researcher, you have to be particularly careful about keeping the two sides separate. There is no way anyone should be allowed to store research data in the clinical record -- even if the researchers otherwise have access to the clinical chart. Also -- it should be mentioned that not all study data is automatically PHI. In fact, most of it shouldn't be. Once it's been de-identified, then the data isn't PHI any more and can be more freely used for research. This is why there is so much emphasis on the security for storing the "unblinding" documentation.

mjevans 9y ago

Mostly in preparation for sharing the study data with others (E.G. Publishing, outside data processing). It's just good hygiene to have the non-sensitive data isolated from the sensitive stuff. Identifying information belongs under lock and key, or at least forcing a user to authenticate again (even if by literal physical key-fob/ID card) (and should for the hospital too). Answers to questions which can't be classified as the above can be associated with a fully synthetic ID that works as a pointer to the above. That makes them less sensitive (but still important to keep secure: E.G. they could be in the office which is always locked when un-occupied and don't have to be stored in the safe). Practicing this discipline also makes it less likely for researchers and writers to inadvertently leak patient data. I'm actually shocked at how often hospitals / clinics / etc don't practice similar division of data by storage requirement.