Integrating a Federated Healthcare Data Query Platform With Electronic IRB Information Systems Shan He IPHIE 2010

2 Background Clinical research –Investigating new approaches to treatment, cure and prevention of diseases –Important in improving the quality of heath care Breakthroughs in basic research Translate basic research breakthroughs to clinical practice –Require clinical research involving human subjects

3 Human Subject Protection Department of Health and Human Services’ Protection of Human Subjects (Title 45 CFR part 46, Common Rule) Food and Drug Administration’s (FDA) Protection of Human Subjects Regulations (Title 21 CFR part 50)

4 HIPAA Privacy Rule Protected Health Information (PHI) –Individually identifiable health information that is transmitted or maintained in any form or medium (electronic, oral, or paper) by a covered entity or its business associates Limited access to PHI –Authorization from research subject –Waiver or alterations of Authorizations by an IRB/Privacy Board

5 HIPAA Privacy Rule and Research Clinical researchers require access to many sources of health information (e.g. archived medical records, epidemiological databases, tissue repositories) The Privacy Rule requires covered entities to obtain additional documentation from researchers before disclosing health information to them, and to scrutinize researchers' requests for access to health information more closely.

6 Institutional Review Board IRB--committees that have been formally designated to review, approve and monitor any research involving humans The Common Rule requires IRB to conduct continuing review of research to ensure compliance of regulations

7 Problem Statement Major challenges for IRBs during oversight of human subjects protection –Bureaucratic and time-consuming review procedure –Difficulty of adequate continuing review to ensure investigators comply with their approved protocols –More complicate process of obtaining ethics review for multi-site studies

8 Current Challenges Investigator –IRB application: inclusion and exclusion criteria not explicit enough for IRB to make a decision –Data request: separately submitted to a clinical data source administrator Data Provider –Required to make sure the investigator has obtained IRB approval (and what has been approved) IRB –No control over the actual data access process

9 System Proposal Integrated system which interconnects a federated healthcare data query platform with electronic IRB systems –streamline the clinical research process –speed research initiation –increase efficiency and patient privacy

10 Federated Healthcare Data Query Platform Researchers require data drawn from multiple sites and multiple data sources Federated Healthcare Data Query Platform –Virtually integrate disparate data sources –Provide a unified query interface –A example: Federated Utah Research and Translational Health e-Repository (FURTHeR)

11 FURTHeR Overview Data sources to be integrated: –University of Utah Healthcare –Intermountain Healthcare –Salt Lake City Veterans Administration Medical Center –Utah Department of Health –Utah Population Database (UPDB, an extensive genealogic and demographic resource) Query interface (MyRA) –Aggregated count query –Detailed, federated results joining the query results from each data source

FURTHeR

13 FURTHeR Security Protects patient health information and limits accessibility to authorized entities to ensure privacy A federated security model is complex –Confidentiality (e.g. message encryption) –Integrity (digital signature) –Federated authentication –Federated authorization

14 Federated Authorization Most complex component –Users from different institutions have different roles; Each role has different defined privileges –Simple role-based access control is not adequate for the federated query service to make the right authorization decision –Regulatory compliance (protocol-specific authorization)

15 System Architecture

16 Implementation Service-Oriented Architecture (web service interface of ERICA) Message communication between FURTHeR and ERICA –Use the standard clinical study information content currently being developed by HL7 Regulated Clinical Research Information Management (RCRIM)

17 Discussion Integration with multiple electronic IRB systems –Implementation challenges Not the only safeguard mechanism to ensure information security and patient privacy –Other security steps should be implemented together with IRB system integration

18 Discussion An obstacle for study investigators is the inability to recruit enough participants (public concern about privacy issues) The integrated system could provide the general public with an access interface to regulatory information of studies –Enhance public trust –Improve study enrollment

19 Acknowledgments Committee –Dr. Scott Narus (PhD Committee Chair) –Dr. John Hurdle –Dr. Jeffrey Botkin –Dr. Lee Min Lau –Dr. Julio Facelli Public Health Services research grant UL1- RR from the National Center for Research Resources Contact –Shan He  Department of Biomedical Informatics, University of Utah  19