Sample verbiage delineating the separation of the data management and research teams.
| HIPAA = Health Insurance Portability and Accountability Act; ID = identification. |
| The data management team will use the registry data to generate patient-activation materials on behalf of participating practices. The practice and data management team will establish a business use agreement and will outline the following data-sharing protocol. Participating practices and data management team will establish a HIPAA business associate agreement authorizing the data management team to serve as the registry data repository for quality improvement purposes. The agreement will outline the steps for de-identifying data, securing the data using appropriate computer technology, and destroying or returning the data after analyses are completed. The data management team will strip the data of all identifying information before sending them to the research team for evaluation purposes. The data management team will assign a temporary random-digit ID number for tracking purposes. Each time the data management team sends an updated data set to the research team, they will assign patients new temporary random-digit ID numbers, which will be destroyed as soon as the data management team transfers the new data set. The research team will delete the outdated data set and load the new data set each time a transfer is made. |