Research Use of Electronic Patient Information:
URMC Policy Statement

1. Any research project that employs patient information taken from the electronic medical records of the Medical Center must be reviewed by the RSRB. The investigator may apply to the RSRB for a study exemption or an expedited review, as outlined in the RSRB handbook. Either case requires the investigator to submit a study proposal that includes a rationale for the study, describes the data requested, and outlines measures that will be taken with respect to the confidentiality and security of the research data. The protocol should also indicate whether patient consent will be obtained. If the researcher does not intend to obtain patient consent, sufficient justification should be provided to the RSRB so the RSRB can determine whether it will waive consent in accordance with applicable regulations.

2. Investigators who require research data sets that contain identifying information must provide for stricter access controls and confidentiality protections than those who employ data sets stripped of identifiers that support discovery of the individual patient. Investigators must provide a compelling rationale for requesting identifying rather than anonymous data. Studies that employ identifying data will receive a more rigorous review by the RSRB. No publication can contain patient-identifying information without patient consent. Investigators whose studies will employ anonymous data sets must still apply to the RSRB for review as exempt studies.

3. Upon approval by the RSRB, the investigator must arrange with the SMH Office of Clinical Practice Evaluation (OCPE) to extract the requested data. OCPE will perform a "need-to-know" assessment, design an appropriate extraction algorithm, and deliver requested data to the investigator in an agreed-upon format on a mutually acceptable timetable. The algorithm for making records anonymous will remove the name, social security number, parent's name, street address, provider name and other identifying information as appropriate.

4. The investigator will sign a receipt for the data received from OCPE, acknowledging responsibility for proper management and protection of the data. OCPE will retain records about patient information that has been released for research purposes, in accordance with state and federal guidelines.

5. The security and integrity of extracted data are the responsibility of the investigator. Patient data taken from the electronic clinical records of Strong Memorial Hospital belong to the institution. When data are no longer needed by the investigator, or when an investigator leaves, appropriate arrangements must be made regarding the disposal of the research data set.

6. Records containing HIV-related information or information about alcohol/drug abuse treatment cannot be extracted for research purposes without additional authorizations. The investigator's research proposal to the RSRB should include assurances that appropriate authorizations have been arranged.