SHARING PATIENT DATA FOR RESEARCH: UVA HEALTH PRIVACY OFFICE GUIDANCE
This guidance describes how researchers can safely share data derived from the medical record, internally, under contract, and publishing publicly (no access control). Data shared and published via this product must comply with this guidance.
Access to Patient Data for Research
Refer to IRB-HSR guidance. Sharing data within your research team and transfer outside of your team must follow your data security plan.
Guidance for Sharing Row-level Patient Data for Research
Row-level UVA patient data can only be shared with researchers outside of UVA under contractual agreements established through the UVA Office of Sponsored Programs via the School of Medicine Office of Grants and Contracts. Refer to their website for more information. Note that shared data typically consists of limited data sets or de-identified data, with some exceptions. UVA requires a contractual agreement to cover data sharing even when the data is de-identified.
Guidance for Publicly Sharing Patient-Derived Aggregate Datasets
Limited datasets or de-identified UVA patient data can only be publicly shared when first aggregated, such that any fact or any set of related facts represents at least 11 individuals. This is consistent with the Centers for Medicare & Medicaid Services (CMS) aggregation methods when publishing patient data.