# Presentation: 160436

## VA Research Information Security 

**Joseph Francis, MD, MPH**
**Deputy Chief R&D Officer **

## The World is Changing

- Incredible growth in data storage and transmission, mobile computing, and the reach of “smart technology”
- Increased use of large datasets and sophisticated analytics in research
- Societal concerns about privacy, confidentiality esp. Genomic Information
- Cyberwarfare

## Multiple Choice:How often are Military and Government Computers Attacked?

- Once a week?
- Daily?
- Every hour?
- Each minute?
- Every second?
- Every millisecond?

***Source:  The Economist, September 8, 2007***

## Concerns regarding VA Research & Cyber-security

**Large data sets with PHI & identifiers**
**VA leads the world in electronic records**
**VA also uses DoD & Medicare Data **
**Genomic medicine raises new concerns**
**VA investigators have many collaborators**
**Abundance of devices**
**VA data may reside outside of VA firewall**
**Perceptions about researchers**

## IT Security Tipping Point

***Info Access***

***Info Restriction***

** ****Clinical Care**
** ****Research collaborations**
** ****Training Programs**
** ****Quality improvement**

** ****Federal law**
** ****Congress**
** ****OMB**
** ****Veterans groups**
** ****Public distrust**
** ****Litigation**

## Types of Research Data

**Non-human research: almost always NOT sensitive *****(some rare exceptions)***
**Animal data**
**Laboratory data without human identifiers**
**Human subjects data:**
**Primary data (individual subjects) is usually sensitive, with varying degrees of risk**
***Aggregate data is NOT sensitive***
**Manuscripts and Grants/Protocols:**
**Not considered sensitive from the organization’s perspective**

## Types of VA Human Research

- Clinical observational studies
- Subjects may be few or many
- Sometimes includes consent & HIPAA authorization
- Clinical trials (e.g., VA Cooperative Studies)
- Testing one therapy against another
- Usually multi-site with outside collaborators
- Subjects number hundreds to thousands
- Informed consent & authorization is routine
- Records-based research (Health Services R&D)
- Looks at patterns of care in large populations
- Subjects can be in the millions
- Consent & HIPAA authorization usually waived
- Problem:  need identifier to cross-link records

## The local Human Research Protection Program is the Gatekeeper and Guardian for Sensitive Data in Research 

## Elements of Local HRPP

- Institutional Review Board
- Research and Development Committee
- Research Office
- Compliance and QA reviews
***New:*** adding expertise in Privacy and Information Security
- Ex officio, non-voting member to IRB or R&D committee
- Best if involved “upstream” with investigator

## Approval criteria for IRBs

- Risks to subjects minimized
- Risks reasonable in relation to benefits
- Equitable selection of subjects
- Prospective informed consent
- Document informed consent
- Adequate provisions for safety monitoring
- Adequate protection for privacy, confidentiality
- Protection of Vulnerable Subjects
- Conflict of Interest
- Ensure Investigator educational requirements and certifications

## Sharing Research Data: Often appropriate and necessary

- With collaborators and those with specialized expertise
- Research is a team sport!
- Multi-site studies – with data coordinating center
- With outside sponsors of research
- In clinical trials, adverse event monitoring is needed for safety and mandated by FDA
- Written consent and HIPAA authorization is equivalent to formal release of information
- Data transfers to affiliate: *convenience or necessity?*

## When is Data “De-identified”?

- “Scrambled SSNs” ARE identifiers
- “Hidden” identifiers often exist
- You may think you’ve deleted an identifier, but without proper sanitization, it may still be recoverable
- Personal attributes may still be used to identify a subject
- Strictly de-identified data is usually not usable to the clinical researcher

## The Spectrum of Identifiability

- Direct identifiers (names, SSN)
- Indirect identifiers:  attributes (dates of hospitalization; gene sequence) that uniquely identify an individual
- 30 to 80 single nucleotide polymorphisms
- As few as six variables in a survey*
- In the world of “cloud computing”, it becomes harder to stay anonymous

- * www.fcsm.gov/cdac/index.html

## Names or initials
All geographic subdivisions smaller than a state
All dates except the year and all ages over 89
Telephone numbers
Fax numbers
E-mail addresses
Social Security Numbers
Medical record numbers
Health plan beneficiary numbers
Account numbers
Certificate or license numbers
Vehicle identifiers and license plate numbers
Device identifiers and serial numbers
URLs
IP addresses
Biometric identifiers, including finger and voice prints
Full-face photographs & comparable images
Any other unique #, characteristic or code

**All geographic subdivisions smaller than a state**
**All dates except the year and all ages over 89**
**Telephone numbers**
**Fax numbers**
**E-mail addresses**
**Social Security Numbers**
**Medical record numbers**
**Health plan beneficiary numbers**
**Account numbers**
**Certificate or license numbers**
**Vehicle identifiers and license plate numbers**
**Device identifiers and serial numbers**
**URLs**
**IP addresses**
**Biometric identifiers, including finger and voice prints**
**Full-face photographs & comparable images**
**Any other unique #, characteristic or code**

- “De-identified” for HIPAA - NO:

## “There is no shortage of public and commercial databases about people’s lives...statisticians have many techniques for identifying data subjects from partial data”              Lowrance and Collins, Science, August 3, 2004

## Best Practices

- ISO and Privacy Officer involved in IRB and R&D Committee deliberations and upstream with PI
- Posters and Laminated cards with key contacts
- Strong local leadership support
- Executive “walk rounds” highly valuable
- Data secured on VA server
- Approved Business Partner Gateway agreements

***“******Information Security is a Marketing Job”***

## A Brief IT Security Checklist(see OI&T Oversight & Compliance for full Checklist)

- Data are used only as specified in an approved protocol
- Reasonable and appropriate protections are implemented
- Before removing data from VA, supervisor and ISO is consulted
- Is data appropriately protected?
- Written authorization?
- IT equipment and storage devices are configured according to VA requirements

## Recurring Issues

- Paperwork and protocols
- Data location issues
- Business partner gateways
- Physical security (access, shredding, etc)
- Passwords

## Clinical Trial Monitors

- FDA requirements for study sponsors to ensure data are valid by checking original  source documents (electronic medical records)
- There are many study monitors – how practical to give each full training and background checks?
- Possible solutions:
- Limited background check
- “Chauffeur”
- Download enrollee data into standalone system

## Research Community – Recurring Concerns from Field

- Blanket treatment of all research data as sensitive/high risk
- Prevents risk-based prioritization of resources
- Delays in sending data to sponsors for safety monitoring
- Clarity on HIPAA authorization needed
- Process needed for addressing use of non-VA servers esp. for multi-site studies

## “If you guard your toothbrushes and diamonds with equal zeal, you’ll probably lose fewer toothbrushes and more diamonds”

- -- Former National Security Advisor, McGeorge Bundy

## Achieving the “Gold Standard” in VA Research

- Information security professionals as a member of the “research team”
- Concept of “RISO”, similar to research pharmacist
- Involved at the beginning of the research design, stays engaged through execution
- Flexible spectrum of solutions that meet the intent of regulations & policy
- Research data infrastructure that facilitates both research and security

## Current Data Flow for Health Services Research

**1**

**Site**
**2**

**Site**
**128**

**Extract**
**Software**

**Extract**
**Software**

**Extract**
**Software**

**Deaths**

**Medicare**
**Claims**

**External **
**Data:**

**National**
**Database**
**(DSS, PBM, etc*)**

**Research**
**Database**

- Researchers

**Custom**
**Extracts**

- Current Data Flow for Health Services Research

## Future Infrastructure to Support Safer Inquiries 

**Diabetes**
**Care Management**
**Data Mart**

**Diabetes Research**
**Data Mart**

**Data**
**Warehouse**

**Health Data**
**Repository**

**Source**
**Systems**

**   ****Acquire****	****    Populate****	**** Create****	****  Access****   Data****	****    Warehouse****	**** Data Marts****	****  Information**

**1**

**3**

**4**

**Common Query,  Reporting, **
**Analysis, & Data Mining Tools**

**2**

***Clinical Care Management Site***

***Research site***

**Care Management**
**Data Mart**

**Research**
**Data Mart**

**Data**
**Warehouse**

**Administrative**
**(DSS, PBM, etc.)**

**Other**
**(Medicare, DoD)**

- Future Infrastructure to Support Safer Inquiries

## Bottom Line: High Stakes

**Assuring information security & privacy protects subjects and facilitates research**
**Negative publicity impacts the local research program, VA research in general, and VHA health care**
**Taking the time to do this well will improve our ability to serve veterans using advances in medical computing and genomic medicine**

## Lessons from High Reliability Organizations

**Don’t let success fool you**
**Don’t oversimplify**
**Listen to the front line and to those with expertise**
**Avoid panic – commit to resilience**
**Accidents happen: anticipate what you can while building capacity to learn & respond**

## Slide 27