California Code of Regulations › Title 11 - Law › Division 1 - Attorney General › Chapter 8.5 - Controlled Substance Utilization Review and Evaluation System (Cures) › Article 3 - Research › Section 828.6 - Procedures for Requesting Identified Individual-Level Data and De-Identified Individual-Level Data from CURES

Current through Register 2024 Notice Reg. No. 28, July 12, 2024
(a) "Data
				  Request Application," when used in this section, means the application developed by
				  the Department's Research Services for a Bona Fide Researcher to obtain approval to
				  receive Identified Individual-Level Data or De-Identified Individual-Level Data from
				  CURES.
(b) A Bona Fide Researcher must
				  electronically submit a completed Data Request Application to the Department's
				  Research Services.
(c) To complete the
				  Data Request Application, a Bona Fide Researcher must provide all of the following
				  information on the Data Request Application:
(1)
				  Designation as a new request or a modified request.
(2) Date of request.
(3) Name, phone number, and email address of the
				  Bona Fide Researcher.
(4) Address, city,
				  state, and postal code of the Bona Fide Researcher.
(5) Name of the public agency or research body
				  with which the Bona Fide Researcher is affiliated.
(6) Name, phone number, and email address of the
				  public agency's or research body's information security officer or IT
				  manager.
(7) Project title.
(8) Date of anticipated completion of the project
				  or the report.
(9) List of information
				  for each Team Member that includes all of the following:
(A) Name of Team Member.
(B) The physical location from which the Team
				  Member will access individual-level data from CURES.
(C) Whether the Team Member is part of the data
				  analysis team.
(D) Whether the Team
				  Member is part of the IT team.
(10) Signature of the Bona Fide Researcher, and
				  date of signature of the Bona Fide Researcher.
(11) Completed Data Request Application checklist
				  that includes all of the following:
(A) Project
				  outline that describes all of the following:
1. The
				  purposes and objectives of the project or report.
2. How the requested data will be used to support
				  the educational purposes, Peer Review purposes, statistical purposes, or Research
				  Purposes, of the project.
3. The
				  expected benefits of the project.
4. If
				  applicable, the funding source of the project or report, including all of the
				  following:
a. Whether the funding source is a
				  public or private grant.
b. The grant
				  period.
c. The grant expiration
				  date.
5. Proposed project
				  design and methodology, including, but not limited to:
a. Where the data analysis will be
				  conducted.
b. A detailed description of
				  the requested individual-level data from CURES.
6. Security measures, compliant with NIST Special
				  Publication 800-171, Revision 2, Protecting Controlled Unclassified Information in
				  Nonfederal Systems and Organizations (February 2020), incorporated by reference in
				  this chapter, that the Bona Fide Researcher has in place to prevent the unauthorized
				  access of hard copies or electronic files containing Identified Individual-Level
				  Data or De-Identified Individual-Level Data from CURES, including, but not limited
				  to:
a. Encryption methods.
b. Anti-virus software.
c. Network security.
d. Physical storage location of the
				  data.
e. Risks or confidentiality issues
				  related to the storage location.
f.
				  Whether the data is stored on a device with an internet connection.
g. Any software protection on the device on which
				  the data is stored.
h. Whether hard
				  copies of the data will be stored.
i. If
				  Identified Individual-Level Data is requested, how the Bona Fide Researcher will
				  ensure the elimination of individual identifiers from subject records or
				  publications when the project is completed.
7. Whether the Bona Fide Researcher is capable of
				  transferring data over a secure file transfer protocol.
8. If applicable, any information pertaining to
				  other formal project approvals, including institutional review board approvals for
				  the academic community.
(B)
				  Curriculum vitae of the Bona Fide Researcher.
(C) Signature of the Bona Fide Researcher, and the
				  date of signature of the Bona Fide Researcher, acknowledging the restrictions on use
				  or disclosure of data from CURES, as specified in section
				  828.4.
(D) Completed Data Request Application security
				  requirements acknowledgement that includes all of the following:
1. The name, the signature, and the date of
				  signature of the public agency's or research body's information security officer or
				  IT manager.
(E) Completed Data
				  Request Application supplemental security requirements acknowledgement that includes
				  all of the following:
1. The name of the public
				  agency or research body.
2. The name,
				  position, signature, and date of signature, of the public agency's or research
				  body's information security officer or IT manager.
(F) Any relevant research materials, including,
				  but not limited to:
1. Proposals.
2. Endorsements.
3. Questionnaires.
(G) Copy of the institutional review board
				  approval and all documentation submitted as part of that review and approval
				  process, including the application number and expiration date. This requirement is
				  not applicable if the Bona Fide Researcher is a public health officer, acting in the
				  capacity of a public health officer, and is requesting De-Identified
				  Individual-Level Data. This approval must demonstrate that the institutional review
				  board is aware of, and has considered, relevant federal and State laws and
				  regulations regarding the general use of human subjects, and specifically the use of
				  human subjects who are incarcerated, minors, or otherwise vulnerable
				  populations.
(H) If the Bona Fide
				  Researcher is requesting Identified Individual-Level Data, the Bona Fide Researcher
				  must comply with Civil Code section
				  1798.24, subdivision
				  (b), or Civil Code section
				  1798.24, subdivision
				  (t).
1. To comply with Civil Code section
				  1798.24, subdivision
				  (b), for purposes of this article, the Bona Fide Researcher must provide a signed
				  CURES 0001 Consent for Use of Personal Information from CURES form (Orig. 07/2021),
				  incorporated by reference in this chapter, for each individual for whom Identified
				  Individual-Level Data is being requested on the Data Request Application. Each
				  signed Consent for Use of Personal Information from CURES form must be retained for
				  at least as long as each consenting individual's Identified Individual-Level Data is
				  retained by the Bona Fide Researcher. The Bona Fide Researcher must obtain a signed
				  Consent for Use of Personal Information from CURES form from each individual not
				  more than 30 days before obtaining the individual's Identified Individual-Level Data
				  from CURES, or within the time limit agreed to by the individual in the individual's
				  signed Consent for Use of Personal Information from CURES form. A Bona Fide
				  Researcher must not obtain an individual's Identified Individual-Level Data from
				  CURES outside of that 30 days, or the time limit agreed to by the individual in the
				  individual's signed Consent for Use of Personal Information from CURES form, unless
				  the individual has provided a renewed Consent for Use of Personal Information from
				  CURES form. If any individual withdraws consent to obtain that individual's
				  Identified Individual-Level Data from CURES, the Bona Fide Researcher must
				  immediately notify the Department's Research Services of that withdrawal of
				  consent.
2. To comply with Civil Code
				  section
				  1798.24, subdivision
				  (t), for purposes of this article, the Bona Fide Researcher must obtain formal
				  approval for the use of Identified Individual-Level Data, in accordance with the
				  requirements of Civil Code section
				  1798.24, subdivision
				  (t), by the Committee for the Protection of Human Subjects for the California Health
				  and Human Services Agency or the Bona Fide Researcher's institutional review board,
				  if that institutional review board has a written agreement with the Committee for
				  the Protection of Human Subjects for that institutional review board to provide the
				  data security approvals required by Civil Code section
				  1798.24, subdivision
				  (t). The Bona Fide Researcher may first submit its application to the Department's
				  Research Services. If the Bona Fide Researcher has met all other application and
				  security requirements pursuant to these regulations and would be approved by the
				  Department's Research Services, the Department's Research Services will provide
				  written documentation to the Bona Fide Researcher to allow the Committee for the
				  Protection of Human Subjects to review the Bona Fide Researcher's application. The
				  Bona Fide Researcher must provide written verification to the Department's Research
				  Services of formal approvals by the Committee for the Protection of Human Subjects
				  or the Bona Fide Researcher's institutional review board, if operating under a
				  written agreement under Civil Code section
				  1798.24, subdivision
				  (t), for the request of Identified Individual-Level Data from CURES. The written
				  verification must include the review and determination by the Committee for the
				  Protection of Human Subjects or the Bona Fide Researcher's institutional review
				  board, if operating under a written agreement under Civil Code section
				  1798.24, subdivision
				  (t), that the data security approvals required by Civil Code section
				  1798.24, subdivision
				  (t), have been satisfied.
(I)
				  Certification of human subjects protection training for the Bona Fide Researcher and
				  all Team Members.