Our research occasionally includes access to and use of protected health information
(PHI). This data is protected under the Health Insurance Portability and Accountability
Act of 1996 (HIPAA). We have a strong commitment to protecting the privacy of all
individuals covered by our research. All faculty and staff participating in research
requiring the use of PHI must undergo HHS-developed training. Specifically, they must
complete the following modules found on the HHS HIPAA training site.
- Protected Health Information, Uses and Disclosures, and Minimum Necessary
- Administrative Requirements
Data Storage Policy
All raw data sets containing PHI are stored in password-protected files unless currently
under analysis. In no circumstance will PHI from the raw data set be included in the
analysis file unless absolutely necessary for work to proceed.
Analysis files must be stored on University-owned computers requiring user-authentication
before access and stored in folders only accessible to a single user (i.e., not shared
on the machine). When research concludes, all analysis files will be combined into
a single archive and password protected. Raw data will be destroyed after a reasonable
period, depending on the need for access following questions by peer-reviewers of
Data Use Policy
Data sets containing PHI are used only following University of Memphis Institutional
Review Board approval or granting of a waiver. The acquisition and use of each HIPAA-protected
data set is restricted to a single study unless additional IRB approvals/waivers are
explicitly applied for and granted.
In compliance with HIPAA’s “minimum necessary” requirement, researchers will only
use that PHI which is necessary for successful completion of the project. This determination
will be made by the Director of the Methodist-Le Bonheur Center for Healthcare Economics
at the researcher level, since not all researchers for a given study will need access
to PHI to complete their duties. In order to gain access to PHI data, researchers
(including graduate assistants) must first complete the University of Memphis’s “Education
in Responsible Conduct of Research” training, or an appropriate substitute as determined
by the Director.
A log will be kept of all research staff who access PHI, the type of PHI accessed,
the IRB-approved study it relates to, and the purpose for access. These records can
be reviewed at any time by data suppliers and appropriate regulators.
We do not report rates based on unreliable numbers. An estimate may be unreliable
because (1) it has a denominator of 30 or less or (2) because it has a large relative
standard error. We consider a standard error to be large if it exceeds 30% of the
point estimate. In the first case, we will report the raw numbers for the numerator
and denominator and users are cautioned to interpret these values with caution. In
the second case, we will only publish pooled estimates.