Attachment A.6 Data User Training

National Children’s Study (NCS) Data User Training

• Whatever ... I see or hear... which ought not to be spoken of abroad, I will not divulge, as reckoning that all such should be kept secret. (Hippocratic Oath, circa 4th Century B.C.) 

• Protecting the privacy of the individuals and institutions that are featured in your health research is imperative. The NCS RMDA safeguards the confidentiality of Study participants and institutions. 

<number>

 

Table of Contents

Slide #

1. 1.Introduction………………………………………………………………………………………..3 

2. 2.NCS Data………………………………………………………………………………………….4 

3. 3.NCS RMDA ……………………………………………………………………………………….6 

1. • –Some Definitions 

   • –What is the RMDA 

   • –Responsibilities 

   • –Appropriate Use of Data 

   • –Data Use Restrictions 

   • –Consequences 

   • –Why Adherence is Important 

2. 2.Disclosure………………………………………………………………………………………..10 

   • –Definition and Context 

   • –Policies 

3. 3.HIPAA and Other Relevant Laws……………………………………………………………...14 

4. 4.Publishing Recommendations…………………………………………………………………15 

5. 5.Scenarios………………………………………………………………………………………...16 

6. 6.Review…………………………………………………………………………………………....22 

<number>

 

1. 1.Introduction 

Welcome to the NCS Data User Training!

The NCS is a community built on shared vision, scientific integrity, and common trust.  Because of the sensitive nature of health data, the NCS enforces standards for data access to maintain our commitment of confidentiality to NCS participants as described in the informed consent process.  The standards are also enforced to support a relationship of trust between the federal government and the general public. During this course, we will explain important requirements:

• Describe NCS data at a high level 

• Explain your individual responsibility when using NCS data 

• Note the importance of maintaining privacy of individuals and institutions and confidentiality of information 

• Reduce the risk of inadvertent violations 

This course will take approximately 10 minutes to complete.

<number>

 

1. 2.NCS Data 

<number>

 

1. 2.NCS Data (continued) 

NCS data are a valuable resource for the health research community because they contain information about Study participants, their health, family medical history, and their physical, social, and family environments over the course of a 21-year study.    

• NCS databases bring together information collected from questionnaires, body measurements, and biological and environmental samples.  

• NCS databases also include the identities of institutions, such as hospitals and other health care providers. The identities of these institutions would need to be masked to protect confidentiality. 

• Health researchers may access information about NCS data at www.nationalchildrensstudy.gov.   

• Researchers may publish their findings to promote improvements in child health 

<number>

 

1. 3.NCS Research Materials Distribution Agreement (RMDA) 

Some Definitions

• “Data” refers to data and information collected from participants in the NCS Vanguard Study. 

• “Restricted-Use Data” refers to data that are not publicly available and require approval for release to the data user by an appropriate authority, in accordance with the data governance established by NCS.   

• “Data User” refers to an individual who requests access to NCS restricted-use data and has been approved for use to meet a specific research objective. 

• “Micro Data” are data files in record format such that each variable has a coded value.  Micro data are also referred to as participant-level data, and may include personally identifiable information, or PII. 

• “Summary Data” refers to the aggregate results from analysis of the micro data, such as frequencies, percentage frequencies, or rates. 

What is the RMDA?

• A “RMDA” is a legally binding agreement with NIH that defines how you can use NCS data. You must sign a RMDA before you are given access to NCS data. 

<number>

 

1. 3.NCS RMDA (continued) 

Responsibilities

When working with health information, researchers have a responsibility to maintain the privacy rights of the individuals and institutions featured in their data. It is vital to maintain a balance between protecting data privacy and securing the use of data in national health research.

The NCS RMDA contains specific requirements to protect the privacy rights of the individuals and institutions within the NCS data sets. Guarding the confidentiality of the data you obtain and the privacy of individuals is your responsibility.

Your signature on the RMDA acknowledges that:

• You have read and understand the requirements for using NCS data. 

• You agree to be bound by the federal regulations outlined in the RMDA. 

• You understand the information subject to this agreement, who may have access to NCS data, the limitations on disclosure, the administrative requirements, and the security requirements.  

• You understand that there are civil and criminal penalties for violating any provision of the RMDA. 

• You will be held personally responsible for adherence to each clause in the agreement. Remember, you are responsible, not your organization.  

<number>

 

1. 3.NCS RMDA (continued) 

Appropriate Use of Data

As someone who works with confidential information, it is important for you to know what you can and cannot do with it. You are responsible for how you and others in your research group use the NCS data to which you have access.

• You may use NCS data for research, analysis, and aggregate statistical reporting. 

• You may share NCS data with your immediate research group. Sharing information is critical to research projects, but you must not share NCS data outside of your immediate research group. Please note that each member of the group must take this training. In addition, each must sign the NCS RMDA. 

• When linking any restricted-use NCS data file to another source, the merging of data sources may increase disclosure risk.  In turn, the resulting data file shall be considered a restricted-use data file and must be managed according to the terms of the NCS-approved RMDA.  

• You may only use NCS data in accordance with the approved analytic plan. 

 

Appropriate Use of Data DUA License Excerpt 1

“Licensee shall not disclose data to unauthorized persons; nor shall data be applied in any manner to change the status, condition, or public perception of any individual or community regarding whom nonpublic-use data is maintained.”

<number>

 

1. 3.NCS RMDA (continued) 

Use Restrictions

You are prohibited by the NCS RMDA from:

• Using the data for commercial or competitive purposes. 

• Using the data to determine the rights, benefits, or privileges of individual establishments. 

• Contacting an institution to question, verify, or discuss the data. 

Consequences

When you sign the RMDA, you agree to comply with the requirements listed. If you violate any of the terms and conditions of the RMDA, the following consequences may occur.

• Revocation of data access: Immediate revocation of the license by the NCS 

• Legal consequences: Any violation of this license may also be a violation of Federal criminal law under the Privacy Act of 1974, the Federal Information Security Management Act of 2002, and the Certificate of Confidentiality issued by the National Institutes of Health, and therefore, be subject to prosecution by the U.S. Attorney General. 

Why Adherence Is Important

• Strict adherence to the NCS RMDA ensures the long-term viability of NCS. Violations of the RMDA could force NIH to discontinue providing public release versions of the data. The proper use of NCS databases, including strict adherence to the RMDA, will help protect the availability of this valuable data resource.  

<number>

 

1. 4.Disclosure 

Definition and Context

Disclosure relates to inappropriate attribution of information to a data subject, whether an individual or an institution.

 

Disclosure occurs when

• a data subject is identified from a released file,  

• sensitive information about a data subject is revealed through the released file, or  

• the released data make it possible to determine the value of some characteristic of an individual more accurately than otherwise would have been possible.  

As mentioned earlier, NCS data contain information about Study participants, their health, family medical history, and their physical, social, and family environments. For confidentiality purposes, the NCS has removed all data elements that directly identify an individual.

However, through deliberate and sophisticated technical analysis, it might be possible to ascertain the identity of particular persons. This would be considered a violation of the NCS RMDA. Any attempts to identify individuals are prohibited, and information that could identify individuals directly or by inference must not be released or published.

<number>

 

1. 4.Disclosure (continued) 

Policies

• Do not attempt to learn the identity of individuals or institutions, and prohibit others from doing so.
  
  NCS data exclude information that could directly identify individuals, such as names and addresses of Study participants or institutions. The RMDA prohibits users from making any effort to discover the identity of any individual or institution in the data.
  
  This restriction includes Study participants or institutions.  It is also your responsibility to prohibit anyone else who has access to NCS data from identifying individuals or establishments within the data. Furthermore, employers, hospitals, providers, or industries should not be named as residing in sampled areas. 

• Do not report tabulated data in a cell size less than 10.
  
  In a small sample, an identity could be determined indirectly (e.g., a single case of AIDS in a small town). Such a disclosure would be a direct violation of the privacy rights of that individual.
  
  Tabulated data refers to presented count data and data derivable from a presented table.  Derived counts refer to tables where multiple rows and columns are presented allowing a careful reader to infer a smaller count. 

<number>

 

1. 4.Disclosure (continued) 

Policies (continued)

• Do not contact any institution to verify the data within the NCS data files. 

 

• Do not report names of geographic areas that are smaller than the primary sampling unit. 

 

• Do not include maps of geographic areas that depict secondary sampling units (or smaller). 

 

• Any images of faces shown should make clear that informed consent for use of facial image is given or that the image is a stock photo. 

• Do not describe potential or enrolled participant demographics or health status at the individual level. 

<number>

 

1. 4.Disclosure (continued) 

Policies (continued)

• Protection of Individual Identities RMDA License Excerpt 1  

“Licensee shall not make any publication or other release of nonpublic-use data regarding  individuals (e.g., nonaggregated data) even if the individual identifiers have been removed.”

• Protection of Individual Identities RMDA License Excerpt 2  

“Licensee may publish the results, analysis, or other information developed as a result of any research based on nonpublic-use data made available under this license only in summary or statistical form so that the identity of individuals and communities contained in the nonpublic-use data, alone or in conjunction with other extant data, is not revealed.”

<number>

 

1. 5.HIPAA & Other Relevant Laws 

The HIPAA Privacy Rule sets national standards for patient rights with respect to health information. This rule protects individually identifiable health information by establishing conditions for its use and disclosure by covered entities.

NIH and the Definition of Covered Entities

NIH is not a covered entity because they do not fit the definition of a:

• Health plan 

• Health care clearinghouse 

• Health care provider that electronically transmits health information 

NCS Data are Restricted-Use Data Sets

NCS databases consist of aggregate data.  Direct identifiers specified in the Privacy Rule have been removed.  Values of less than 10 are suppressed.

NCS is consistent with HIPAA regulations

The NCS DUA is commensurate with HIPAA requirements for use of a limited data set.

Further information on the HIPAA Privacy Rule can be found at: http://www.hhs.gov/ocr/hipaa or http://privacyruleandresearch.nih.gov/.

<number>

 

1. 6.Publishing Recommendations 

NIH/NICHD must demonstrate that NCS data are used to generate significant research contributions that satisfy the mission of the Agency. Therefore, it is crucial to properly cite and acknowledge NIH and the specific NCS databases used in your publication.

Publishing Recommendations
It is important that you properly acknowledge NIH and the specific databases used in your publication.

For primary NCS publications: “This manuscript was developed by a Writing Team identified by the NCS Publications Committee for the purpose of timely sharing of centrally-collected NCS data. It is thus a primary NCS publication.”

For any NCS-related publications: “This analysis was conducted as part of the National Children’s Study, supported by the Eunice Kennedy Shriver National Institute of Child Health and Human Development, and funded, through its appropriation, by the Office of the Director of the National Institutes of Health.”

<number>

 

1. 7.Scenarios  

Scenario 1

Sara: "Hi Donna. How is your research report coming along?"

Donna: "Great. I am using NCS data to study a rare medical condition, Kawasaki's disease in children. In certain P, the incidence of the condition reveals only one or two cases of the disease in a given year. I would like to publish these findings and include a table recording the incidence of the disease for these areas. However, within the table there will be 'cell sizes' under 10. Can I get an exception for this restriction and publish it with these smaller cells?"

Can Donna publish her findings of the incidence of Kawasaki's disease?"

Choose the best answer.

1. A.Yes, since this is a rare disorder, Donna can publish her findings. 

2. B.Yes, if she receives approval from Sara, her supervisor. 

3. C.No, this would be in violation of the NCS RMDA. 

<number>

 

1. 7.Scenarios (continued) 

Scenario 1 Answer:

 

C. No, this would be in violation of the NCS DUA.

The NCS RMDA stipulates that all published results must be reported with cell sizes greater than or equal to 10. One or two cases of a rare medical condition in a given geographic area are too few to report while preserving confidentiality. Cell sizes fewer than 10 could inadvertently reveal identity. These cases will need to be reported by combining the geographic areas up to a cell size greater than or equal to 10.

<number>

 

1. 7.Scenarios(continued) 

Scenario 2

John is a new research contractor with Health Research Services, Inc. How can John and his colleague abide by the terms of the NCS RMDA?

John: "I'd like to do a primary sampling unit-level comparison that incorporates health and demographic data.  I want to include health provider information, health outcomes, and race/ethnicity data in my report.  How can I use NCS data within my report?”

Tom: "Perhaps you could link county records concerning demographics using extant data residing in the data enclave (that houses data from other studies) with the health information contained in the NCS data."

Under what conditions can John use the NCS data within the data enclave? (Choose all that apply).

1. D.If he signs a RMDA 

2. E.If John doesn't disclose geographic detail more specific than the primary sampling unit level  

3. F.If John doesn’t identify health care providers 

4. G.If he uses his research for marketing purposes 

<number>

 

1. 7.Scenarios (continued) 

Scenario 2 Answer:

1. A.If he signs a RMDA,  

2. B.If John doesn’t disclose geographic detail more specific than the primary sampling unit level, and  

3. C.If John doesn’t identify health care providers.
    

Health care provider-level analysis can be done, but the identification of providers must be protected. John can enhance his data with links to other data, but he must stay within the limits of the NCS RMDA. Also, as a member of the research group, John must sign the RMDA. Use of NCS data for marketing purposes, such as using the information in the NCS data for commercial or competitive purposes involving individual hospitals, is a violation of the RMDA.

<number>

 

1. 7.Scenarios (continued) 

Scenario 3

Lisa: "Lakeview Hospital. This is Lisa speaking."

Stephen: "Hi Lisa, my name is Stephen Gossling. I am a health care researcher with Burnside University. I am using NCS data to research the prevalence of newborn respiratory illnesses within the western United States. I have some questions about your data on newborn respiratory illness and would like to verify the number of cases that were admitted to your hospital three years ago."

Which of the following is a violation of the NCS RMDA? (Choose all that apply)."

1. H.Contacting an institution to question, verify, or discuss NCS data 

2. I.Identifying individuals within NCS data 

3. J.Linking NCS data to another data source 

4. K.Comparing (benchmarking) results from the NCS data to another data source 

<number>

 

1. 7.Scenarios (continued) 

Scenario 3  Answer:

1. D.Contacting an institution to question, verify, or discuss NCS data and  

2. E.Identifying individuals within NCS data
    

Stephen's actions are in violation of the NCS RMDA. Stephen cannot contact an institution to question, verify, or discuss NCS data, or to identify individuals within the data. However, Stephen can link NCS data to additional data sources that reside in the data enclave. Stephen may also benchmark his results from NCS data to another data source.

<number>

 

1. 8.Review 

During this course, you have learned the importance of adhering to the regulations outlined in the RMDA.

Let's review key elements about the NCS and the NCS RMDA.

The NCS
The NCS is a community built on shared vision, scientific integrity, and common trust.  Because of the sensitive nature of health data, the NCS enforces standards for data access to maintain our commitment of confidentiality to NCS participants as described in the informed consent process. It is essential to provide safeguards for such data in order to protect the privacy of individuals. This emphasis on protection also helps to ensure that NCS data remain available for future health care research.

NCS Data

NCS data are a valuable resource for the health research community, because they contain information about Study participants, their health, family medical history, and their physical, social, and family environments over the course of a 21-year study.  

<number>

 

1. 8.Review (continued) 

What is the DUA?

The RMDA is a legally binding agreement with NIH that defines how you can use NCS data. You must sign a DUA before you are given access to NCS data.

Your signature on the RMDA acknowledges that:

• You have read and understand the requirements for using NCS data. 

• You agree to be bound by the federal regulations outlined in the RMDA. 

• You understand the information subject to this agreement, who may have access to NCS data, the limitations on disclosure, the administrative requirements, and the security requirements.  

• You understand that there are civil and criminal penalties for violating any RMDA provision. 

Data Use Restrictions
You are prohibited by the NCS RMDA from:

• Using the data for commercial or competitive purposes. 

• Using the data to determine the rights, benefits, or privileges of individual establishments. 

• Contacting an institution to question, verify, or discuss the data. 

Why Adherence is Important
It is important for you to understand the confidential nature of NCS data and what you can and cannot do with it. Everyone given access to the NCS data must sign a RMDA which outlines how the data may be used. Civil or criminal penalties will be enforced for anyone who violates the requirements of the NCS RMDA.

<number>

 

1. 8.Review (continued) 

Disclosure

Through deliberate and sophisticated technical analysis, it might be possible to ascertain the identity of particular persons. This would be considered a violation of the NCS RMDA. Any attempts to identify individuals are prohibited, and information that could identify individuals directly or by inference must not be released or published.

Policies

• Do not attempt to learn the identity of individuals or institutions, and prohibit others from doing so. 

• Do not report tabulated data in a cell size less than 10.  

• Do not contact any institution to verify the data within the NCS data files. 

• Do not report names of geographic areas that are smaller than the primary sampling unit. 

• Do not include maps of geographic areas that depict secondary sampling units (or smaller). 

• Any images of faces shown should make clear that informed consent for use of facial image is given or that the image is a stock photo. 

• Do not describe potential or enrolled participant demographics or health status at the individual level 

<number>

 

1. 8.Review (continued) 

HIPAA
While NIH is not a covered entity, the NCS RMDA is consistent with HIPAA requirements for use of a limited data set.

Publishing Recommendations
It is important that you properly acknowledge NIH and the specific databases used in your publication.

Helpful Resources

• NCS User Support Web site - Everything about NCS data, tools, and products  

• Department of Health and Human Services/HIPAA Site - The Office of Civil Rights  

• Privacy Rule and Research/HIPAA Site - The National Institutes of Health  

<number>

 

File Type	application/vnd.openxmlformats-officedocument.presentationml.presentation
File Modified	0000-00-00
File Created	0000-00-00