Current through Register No. 40, October 3, 2024
Except as otherwise provided by law, upon the approval of
the Comprehensive Health Care Information System privacy review committee
established by He-W 950.07, confidential health
care research data sets shall be released to principal investigators for the
purposes of research under the following conditions:
(a) When the principal investigator submits a
completed written application developed by the department that contains the
following:
(1) The principal investigator's:
a. Name, address, and phone number;
b. Organizational affiliation;
c. Professional qualification; and
d. Name and phone number of principal
investigator's contact person, if any;
(2) The names and qualifications of
additional research staff, if any, who will have access to the data;
(3) A research protocol which contains:
a. A summary of background, purposes, and
origin of the research;
b. A
statement of the health-related problem or issue to be addressed by the
research;
c. The research
hypothesis or hypotheses to be tested or the specific statistical quantities or
dependencies to be measured; and
d.
The research design and methodology which shall include:
1. A clear definition of exactly how the
records needed for the research will be selected and how the patients and or
employer groups who are the subject of the research are defined;
2. Method of data analysis;
3. The way in which the requested data will
be used;
4. The procedures for
contacting any persons or facilities named in records, if applicable;
5. The procedures to obtain informed consent
from the patients, employer groups or other group purchasers, if
applicable;
6. The procedures that
will be followed to maintain the confidentiality of any data or copies of
records provided to the principal investigator; and
7. The intended research completion date;
and
(4)
Information about the data set being requested including:
a. The time period of the data
requested;
b. The minimum needed
specific data items or fields of information required;
c. The minimum needed specificity of those
data items;
d. The selection
criteria for the minimum needed data records required; and
e. Any special format or layout of data
requested by the principal investigator.
(b) The application shall include written
evidence of prior consent for its disclosure from the patients who are the
subject of the information.
(c)
When the data set requested identifies employer or group purchasers, the
application shall include written evidence of prior consent for its disclosure
from the employer or group purchasers that are the subject of the
information.
(d) The principal
investigator shall submit a signed data use agreement that specifies that the
principal investigator shall:
(1) Use the
data for only the purpose specified in the application;
(2) Establish appropriate safeguards to
protect the confidentiality of the data and prevent unauthorized use of the
data;
(3) Not use or further
disclose or sell the data set or statistical tabulations derived from the data
set to any person or organization other than as described in the application
and as permitted by the data use agreement without the written consent of the
department;
(4) Not use or further
disclose the information as otherwise required by law;
(5) Not seek to ascertain or disclose the
identity of patients or employers or other group purchasers revealed in the
data set for any purpose except as approved as part of the study;
(6) Not publish or make public the content of
cells that contain counts of patients in statistical tables in which the cell
size is more than 0 and less than 5;
(7) Not publish or make public any
information that could be used to ascertain the identity of providers of
abortion services;
(8) Report to
the department, within 5 days, any unauthorized use or disclosure of the
information, of which the principal investigator becomes aware, that is
contrary to the agreement;
(9)
Provide the department with a preview copy of a proposed release at least 15
days prior to any publication or release of any reports or publications
containing information derived from the data set for review and verification
that the conditions of the agreement have been met;
(10) Not release any document which is deemed
determined to breach the conditions of the agreement;
(11) Acknowledge the department as the source
of the data in any and all public reports, publications, or presentations
generated by the principal investigator from these data;
(12) Specify that the analyses, conclusions,
and recommendations drawn from such data are solely those of the principal
investigator and are not necessarily those of any agency of the State of New
Hampshire;
(13) Retain the data
only for the period of time necessary to fulfill the requirements of the data
request;
(14) Return the data
within 30 days of the scheduled completion date of the project, or destroy the
data, so certifying by submitting a written notice to the department, or
reapply for approval within 60 days of scheduled completion if the principal
investigator determines the end date of the project needs to be extended;
and
(15) Acknowledge that failure
to adhere to the data use agreement will be cause for immediate recall of the
data, revocation of permission to use the data, and application of any
applicable criminal liability under New Hampshire state law.
(e) Confidential research data
sets shall be released when:
(1) The
application submitted is complete pursuant to (a) through (c) above and the
principal investigator has signed the data use agreement as specified in (d)
above;
(2) Procedures to ensure the
confidentiality of patients, employer groups, or other group purchasers are
documented;
(3) The study, if
carried out according to the application submitted, will be able to answer the
research hypothesis as stated in the application;
(4) There is no evidence that the applicant
is seeking the requested data for other purposes in addition to research
purposes;
(5) The applicant is
seeking only the data necessary to fulfill the specific requirements of the
research study;
(6) The
qualifications of the principal investigator and research staff are documented
by:
a. Training and previous research,
including prior publications in the proposed or related area; and
b. An affiliation with a university, private
research organization, medical center, state agency, or other institution that
will provide sufficient research resources;
(7) No other state or federal law or federal
regulation prohibits release of the requested information; and
(8) Approval has been obtained from the
researcher's affiliated Institutional Review Board operating in accordance with
45 CFR 46, if the researcher intends to contact patients in the
study.
(f) Studies
taking longer than 2 years shall require annual application after the first
2-year period.
(g) The principal
investigator shall comply with the conditions in the data use agreement as
described in (d) above.
(h) In the
event the department determines that any report or publication resulting from
the study, might lead to direct or indirect identification of patients,
employers or other group purchasers unless approved as part of the study
design, the department shall provide a written statement to the researcher
stating specifically the problematic sections in the publication. The
requesting party shall modify the report or publication prior to its release by
fully addressing the problematic sections.
(i) When multiple reports of a similar nature
will be created from the data, upon request the department shall waive the
requirement that any subsequent report or publication be provided to the
department prior to release by the requesting party.
(j) Any draft reports or publications
reviewed by the department shall be kept confidential and shall not be released
by the department.
(k) Information
regarding release of limited use data sets and records of the review of
publications shall be made available upon request.
# 9436, eff
3-21-09
