Some of these methods are relatively inexpensive, but please get an early consultation if you are considering data transmission, with or without data protection methods, so that proper budgeting can be included in your grant or contract. Can I transfer patient information to another facility? My dataset has no name. Does this mean that it is deidentified and can be shared? My dataset does not contain any of the 18 HIPAA qualifiers. can it be shared? How much data can I transfer? What if the data I want to share contains patient names? What if the data I want to share contains patient addresses? What happens if the patient gives written permission to share their personal identifiers, including their name? Can I use a “stupid” ID instead of the name, address, social security number or medical record number? What is a hash draughtsman? Can a hashed ID be hacked? Are there other approaches to conducting location research without transmitting patient data? How much will these methods cost? Do I need to know how to write a data usage agreement? Who signs the data usage agreement? Who do I go to if I have to execute a data usage agreement? The OIC was tasked, on behalf of the Vice-Chancellor in charge of research, with the task of signing research agreements, thus linking the institution to its conditions. Please note that investigators, lecturers, staff and departments are not authorized to sign agreements on behalf of UNC-CH. A hash is like a fingerprint for data. Hashs clearly identify the strings of letters and numbers, but hide actual characters and numbers. A “hash function” is a formula used to create a hash. It defines the logic used to turn a string of characters into a hash. Hashing is much more reproducible than the use of an arbitrary study identifier and safer than direct transmission of patient identifiers such as names. We have gained experience with these methods, including the use of binding algorithms that facilitate the linking or deduplication of patient lists, and we recommend their review. It is recommended to consult the TraCS IDSci or Biostatistics team to make sure this technique matches your research. Visit tracs.unc.edu/consultation to request a consultation with an analyst.
Personal identifiers such as name, address, medical record number, etc., are often referred to as “identifiable personal information” (PII) or “direct identifiers.” Given the nature of the data and the risk to the patient of making a disclosure in the event of an infringement, there is a need for further justification for the need to transmit this data. There may be justifications for the transmission of fully identified data, but, as with all patient-level data exchanges, agreement on the use of the data (and all other appropriate authorizations) is required. The use of patient data for research purposes requires that the work be carried out as part of an IRB.