Section He-C 1504.05 - Release of Confidential Health Care Research Data Sets Except as otherwise provided by law, upon the approval of the Comprehensive Health Care Information System privacy review committee established by He-W 950.07, confidential health care research data sets shall be released to principal investigators for the purposes of research under the following conditions:
(a) When the principal investigator submits a completed written application developed by the department that contains the following: (1) The principal investigator's: a. Name, address, and phone number;b. Organizational affiliation;c. Professional qualification; andd. Name and phone number of principal investigator's contact person, if any;(2) The names and qualifications of additional research staff, if any, who will have access to the data;(3) A research protocol which contains: a. A summary of background, purposes, and origin of the research;b. A statement of the health-related problem or issue to be addressed by the research;c. The research hypothesis or hypotheses to be tested or the specific statistical quantities or dependencies to be measured; andd. The research design and methodology which shall include: 1. A clear definition of exactly how the records needed for the research will be selected and how the patients and or employer groups who are the subject of the research are defined;2. Method of data analysis;3. The way in which the requested data will be used;4. The procedures for contacting any persons or facilities named in records, if applicable;5. The procedures to obtain informed consent from the patients, employer groups or other group purchasers, if applicable;6. The procedures that will be followed to maintain the confidentiality of any data or copies of records provided to the principal investigator; and7. The intended research completion date; and(4) Information about the data set being requested including: a. The time period of the data requested;b. The minimum needed specific data items or fields of information required;c. The minimum needed specificity of those data items;d. The selection criteria for the minimum needed data records required; ande. Any special format or layout of data requested by the principal investigator.(b) The application shall include written evidence of prior consent for its disclosure from the patients who are the subject of the information.(c) When the data set requested identifies employer or group purchasers, the application shall include written evidence of prior consent for its disclosure from the employer or group purchasers that are the subject of the information.(d) The principal investigator shall submit a signed data use agreement that specifies that the principal investigator shall: (1) Use the data for only the purpose specified in the application;(2) Establish appropriate safeguards to protect the confidentiality of the data and prevent unauthorized use of the data;(3) Not use or further disclose or sell the data set or statistical tabulations derived from the data set to any person or organization other than as described in the application and as permitted by the data use agreement without the written consent of the department;(4) Not use or further disclose the information as otherwise required by law;(5) Not seek to ascertain or disclose the identity of patients or employers or other group purchasers revealed in the data set for any purpose except as approved as part of the study;(6) Not publish or make public the content of cells that contain counts of patients in statistical tables in which the cell size is more than 0 and less than 5;(7) Not publish or make public any information that could be used to ascertain the identity of providers of abortion services;(8) Report to the department, within 5 days, any unauthorized use or disclosure of the information, of which the principal investigator becomes aware, that is contrary to the agreement;(9) Provide the department with a preview copy of a proposed release at least 15 days prior to any publication or release of any reports or publications containing information derived from the data set for review and verification that the conditions of the agreement have been met;(10) Not release any document which is deemed determined to breach the conditions of the agreement;(11) Acknowledge the department as the source of the data in any and all public reports, publications, or presentations generated by the principal investigator from these data;(12) Specify that the analyses, conclusions, and recommendations drawn from such data are solely those of the principal investigator and are not necessarily those of any agency of the State of New Hampshire;(13) Retain the data only for the period of time necessary to fulfill the requirements of the data request;(14) Return the data within 30 days of the scheduled completion date of the project, or destroy the data, so certifying by submitting a written notice to the department, or reapply for approval within 60 days of scheduled completion if the principal investigator determines the end date of the project needs to be extended; and(15) Acknowledge that failure to adhere to the data use agreement will be cause for immediate recall of the data, revocation of permission to use the data, and application of any applicable criminal liability under New Hampshire state law.(e) Confidential research data sets shall be released when: (1) The application submitted is complete pursuant to (a) through (c) above and the principal investigator has signed the data use agreement as specified in (d) above;(2) Procedures to ensure the confidentiality of patients, employer groups, or other group purchasers are documented;(3) The study, if carried out according to the application submitted, will be able to answer the research hypothesis as stated in the application;(4) There is no evidence that the applicant is seeking the requested data for other purposes in addition to research purposes;(5) The applicant is seeking only the data necessary to fulfill the specific requirements of the research study;(6) The qualifications of the principal investigator and research staff are documented by: a. Training and previous research, including prior publications in the proposed or related area; andb. An affiliation with a university, private research organization, medical center, state agency, or other institution that will provide sufficient research resources;(7) No other state or federal law or federal regulation prohibits release of the requested information; and(8) Approval has been obtained from the researcher's affiliated Institutional Review Board operating in accordance with 45 CFR 46, if the researcher intends to contact patients in the study.(f) Studies taking longer than 2 years shall require annual application after the first 2-year period.(g) The principal investigator shall comply with the conditions in the data use agreement as described in (d) above.(h) In the event the department determines that any report or publication resulting from the study, might lead to direct or indirect identification of patients, employers or other group purchasers unless approved as part of the study design, the department shall provide a written statement to the researcher stating specifically the problematic sections in the publication. The requesting party shall modify the report or publication prior to its release by fully addressing the problematic sections.(i) When multiple reports of a similar nature will be created from the data, upon request the department shall waive the requirement that any subsequent report or publication be provided to the department prior to release by the requesting party.(j) Any draft reports or publications reviewed by the department shall be kept confidential and shall not be released by the department.(k) Information regarding release of limited use data sets and records of the review of publications shall be made available upon request.N.H. Admin. Code § He-C 1504.05
Amended by Volume XXXVII Number 15, Filed April 13, 2017, Proposed by #12139, Effective 3/22/2017, Expires 9/18/2017.