Who is completing this form?
Principal Investigator/Project Staff ORA CRDW
This form is to gather pertinent details for review by the Clinical Research Informatics Oversight Committee (CRIOC) for projects requiring a Data Use Agreement or atypical uses of electronic health records (EHR).
Please limit responses to free text fields to no more than 2 standard paragraphs including only relevant aspects of your protocol. Failure to comply with this may delay the timing of your review.
PI's Email Address
* must provide value
Will there be, or is there an IRB application for this project?
Yes
No
Unknown
The IRB determined this project is not human-subjects research
No PHI is needed
Other
The IRB determined this project is not human-subjects research
No PHI is needed
Other
What is the current IRB status?
Approved
Pending
Still being written
Approved
Pending
Still being written
Why does this project not have an IRB?
Are there any non-OU collaborators on this study?
Yes
No
Please list details about non-OUHSC collaborators:
Please provide the name(s) of all non-OUHSC collaborator(s):
Please provide the organizational affiliation(s) of non-OUHSC collaborators:
Please provide the role on the study for non-OUHSC collaborator(s):
Please provide details about PII/PHI non-OUHSC collaborator(s) may have access to:
Please provide the name(s) of all non-OUHSC collaborator(s):
Please provide the organizational affiliation(s) of non-OUHSC collaborators:
Please provide the role on the study for non-OUHSC collaborator(s):
Please provide details about PII/PHI non-OUHSC collaborator(s) may have access to:
Please provide the name(s) of all non-OUHSC collaborator(s):
Please provide the organizational affiliation(s) of non-OUHSC collaborators:
Please provide the role on the study for non-OUHSC collaborator(s):
Please provide details about PII/PHI non-OUHSC collaborator(s) may have access to:
Data will be sent to party outside of OUHSC/OU Health?
Yes
No
Please name all entities who will be receiving data outside of OUHSC/OU Health, and the specific reason for sharing data with each entity:
Please indicate the lead site:
OUHSC/OU Health Norman Campus Tulsa Campus External entity Other
Please specify the name of the lead site external entity:
Purpose for sharing data outside OUHSC/OU Health:
Are you requesting PHI to conduct your study/project?
Yes
No
This project is for Quality Improvement purposes only.
Yes
No
Project Specific Aims/Abstract
This project involves a data use agreement (DUA)
Yes
No
Please name the funding source for this project:
(e.g. , "GRF00004020")
Please list all the SoonerTrack Agreement ORA #s, separated by semicolons.
(e.g. ,"ORA00028794".)
Please list all the SoonerTrack Form ID numbers, separated by semicolons.
(e.g. ,"111005".)
This project requires accessing electronic health records (any clinical data existing in an electronic form)?
* must provide value
Yes No Unknown
How will these records be accessed?
How many patient records do you estimate reviewing?
Is OU Health data required?
Yes
No
Is OUHSC data required?
Which EHR systems will used
Please check all planned uses for the data collected for this study:
Please describe the planned use for data collected for this study:
What types of data will this project require? (Check all that apply)
Aggregate data only (patient counts with a minimum cell size of 20)
Patient demographic (including race, ethnicity, gender, age,etc.)
Diagnoses
Data related to psychiatric health and/or substance use and/or other fields that may count as 'sensitive'
Visits/Admissions
Medications
Orders
Procedures
Labs, blood products, specimen
Observations (e.g., vitals, scores)
Notes (history & physical, report notes, other unstructured data)
Room/bed/hospital location
Image summary/impression
Invoice/Transaction
Scheduling
Other
Aggregate data only (patient counts with a minimum cell size of 20)
Patient demographic (including race, ethnicity, gender, age,etc.)
Diagnoses
Data related to psychiatric health and/or substance use and/or other fields that may count as 'sensitive'
Visits/Admissions
Medications
Orders
Procedures
Labs, blood products, specimen
Observations (e.g., vitals, scores)
Notes (history & physical, report notes, other unstructured data)
Room/bed/hospital location
Image summary/impression
Invoice/Transaction
Scheduling
Other
HIPAA Identifiers Needed to conduct this research (check all that apply)
* must provide value
Patient Name
Residential Address (any part, including zip code)
Dates (date of birth, date of admission, date of diagnosis, exact age, etc.)
Phone numbers/other contact information
Medical record numbers, account numbers, etc.
Images
Other data that could potentially identify an individual (such as a very rare diagnosis)
No HIPAA Identifiers are needed
Patient Name
Residential Address (any part, including zip code)
Dates (date of birth, date of admission, date of diagnosis, exact age, etc.)
Phone numbers/other contact information
Medical record numbers, account numbers, etc.
Images
Other data that could potentially identify an individual (such as a very rare diagnosis)
No HIPAA Identifiers are needed
By submitting this form, I acknowledge that I understand that PHI/HIPAA identifiers include any data that could be used to identify a patient, including but not limited to
dates (dates of service, birth dates, dates of diagnosis) age at time of service zip codes rare diagnoses I acknowledge that I will disclose all PHI/PII to be shared outside of OU/OUH systems in this application.
* must provide value
The option "
HIPAA Identifiers to be shared with non-OUHSC/OU Health entity or collaborators (check all that apply)
* must provide value
Patient Name
Residential Address (other than city, state, and zip)
Zip code
Partial zip code (i.e., first 3 digits)
City
State
Dates (date of birth, date of admission, date of diagnosis, exact age, etc.)
Ages in years, months, days, or hours
Phone numbers/other contact information
Medical record numbers, account numbers, etc.
Images
Other data that could potentially identify an individual (such as a very rare diagnosis)
No HIPAA Identifiers will be shared
Patient Name
Residential Address (other than city, state, and zip)
Zip code
Partial zip code (i.e., first 3 digits)
City
State
Dates (date of birth, date of admission, date of diagnosis, exact age, etc.)
Ages in years, months, days, or hours
Phone numbers/other contact information
Medical record numbers, account numbers, etc.
Images
Other data that could potentially identify an individual (such as a very rare diagnosis)
No HIPAA Identifiers will be shared
Please indicate all of the dates/times to be shared:
Please specify other date(s) to be shared:
Please indicate the highest level of granularity/sensitivity to be shared (among the dates/times designated above):
Year Only (e.g., 2021)
Year & month (yyyy-mm)
Year, month, & day (yyyy-mm-dd)
Year through hours (yyyy-mm-dd hh)
Year through minutes (yyyy-mm-dd hh:mm)
Year through seconds (yyyy-mm-dd hh:mm:ss)
Year Only (e.g., 2021)
Year & month (yyyy-mm)
Year, month, & day (yyyy-mm-dd)
Year through hours (yyyy-mm-dd hh)
Year through minutes (yyyy-mm-dd hh:mm)
Year through seconds (yyyy-mm-dd hh:mm:ss)
Please indicate the type(s) of age will be shared:
Age in Years
Age in Months
Age in Days
Age in Hours
Other
Age in Years
Age in Months
Age in Days
Age in Hours
Other
Please specify the other type(s) of age to be shared:
Please indicate all of the identifiers to be shared:
Please indicate the highest level of granularity/sensitivity required (among the MRNs & visit numbers designated above):
Full MRN and/or Account Number
Partial MRN and/or Account Number
Full MRN and/or Account Number
Partial MRN and/or Account Number
HIPAA Identifiers to be shared with non-OUHSC/OU Health entity or collaborators (check all that apply)
* must provide value
Limited dataset identifiers to be shared with non-OUHSC/OU Health entity or collaborators (check all that apply)
* must provide value
Zip code
Partial zip code (i.e., first 3 digits)
City
State
Dates (date of birth, date of admission, date of diagnosis, exact age, etc.)
Ages in years, months, days, or hours
No Limited Data Set Identifiers to be shared.
Zip code
Partial zip code (i.e., first 3 digits)
City
State
Dates (date of birth, date of admission, date of diagnosis, exact age, etc.)
Ages in years, months, days, or hours
No Limited Data Set Identifiers to be shared.
Will an external site be contacting OU Health/OUHSC patients for recruitment, enrollment, primary data collection or follow-up?
Yes
No
How will patients consent to release contact information?
How will contact information be shared and protected?
How will patients be contacted by external entity?
When and how will contact information be destructed?
Please specify 'other' HIPAA data types
If DICOM images are being transmitted, how is the DICOM data being "scrubbed" of PHI?
If the images themselves have "burned in identifiers", how are the images being de-identified or cropped?
Please justify the use of Personal Identifying Information and/or Protected Health Information (per HIPAA minimum necessary standard).
Yes
No
Please briefly describe the EHR needs of this project and the purpose of any HIPAA identifiers needed:
Example1: "Diagnoses and data will be used to identify a prospective list of eligible patients, and patients will be contacted at scheduled visits." Example 2: "Project includes all patients who received remdesivir in 2021."
Please explain the methods used to share data externally.
Examples include: manually entered in electronic data capture system/REDCap/other, electronically submitted, secure file transfer, Box, FTP, etc.
Has an IT Risk Assessment been completed for this sharing method?
Yes
No
Examples include: manually entered in electronic data capture system/REDCap/other, electronically submitted, secure file transfer, Box, FTP, etc.
You indicated this study involves PHI and is subject to IRB review. How is HIPAA addressed in the IRB application? (check all that apply)
How will EHR data for this project be used? (check all that apply)
Briefly describe how EHR data will be used for this study:
Study patient count from EHR extraction will exceed 500
Yes
No
If this project has an IRB application, this should be consistent with "Section 21" of the application.
What is the anticipated count of records to be accessed?
If this project has an IRB application, this should be consistent with "Section 21" of the application.
How will data be delivered to the study team (from CRDW or OU BI)?
Secure File Transfer
Uploaded to REDCap
Saved directly to a location on the secured network drive (user access controlled)
RAVE
Other
Secure File Transfer
Uploaded to REDCap
Saved directly to a location on the secured network drive (user access controlled)
RAVE
Other
Please specify 'other' method for data transfer
Has an IT Security Risk Assessment been completed by OUHSC and OUH?
Yes
No
Has an OU IT security review been conducted for this data transmission method?
Yes
No
Recipient of any dataset (regardless of PHI) is a for-profit organization
Yes
No
Please detail the relationship with the for-profit entity who will receive data:
Research Informatics/Honest Broker team has concerns about broad language in the protocol or study application (e.g., "relevant medical history", "clinical documentation", "outcomes")
Yes
No
Extracted dataset contributes to an external registry
Yes
No
Will any of the entities receiving data outside of OUHSC/OU Health be sharing data outside their organization?
Yes
No
How is access to these data granted and monitored?
Who else is eligible to receive access to the data your team shares (please list any currently known groups who will access your data from the primary recipient entity)?
Please provide a brief description of the registry
IRB, ORA, and/or CRDW has requested CRIOC review
Yes
No
Please note, if you are requesting data to be pulled from the Clinical Research Data Warehouse (CRDW), you must also submit a BBMC request (https://redcap.link/bbmcrequest ) in addition to this CRIOC review screening form. CRIOC review does not automatically generate a CRDW request. http://research.ouhsc.edu/crdw
Please provide any relevant notes about IRB/ORA/CRDW request for CRIOC review if available:
Is there anything else that should be known about this project ?
Submit
Save & Return Later