RECORD-LEVEL DATA REQUEST/ANALYSIS FORM

December 2015

BEFORE STARTING! Is this the right form? Are you requesting use of record-level data or analysis of record-level data? If not, please return to the BORNOntario.ca website for information about the process of requesting aggregated data.
STEP 1 – Tell us About You

Research Organization:

Contact Person Name:

Address:

Telephone: Ext:

Fax:

Email:

Please provide the following information if applicable:

Institutional Affiliation (include department if relevant) and position:

Supervisor Name and Contact Information (if applicant is student):

STEP 2 – Help Us Learn About Your Expectations

___ I want a dataset that I can analyze in my own setting (this means BORN will work with you to de-identify the data before being released). There will be a charge for the data and the preparation of the data.

___ I want to work with a BORN team member to do the analysis in the BORN setting (this means you will only receive the output tables and the work will be done internally at BORN). There will be a charge for the data and the preparation of the data as well as the analysis time.

STEP 3– Make sure you understand the privacy-related terms that will be used

Disclose, as per PHIPA s.2, in relation to health data or personal health information, means: to make the information available or to release it to another health information custodian or to another person, but does not include to use the information.
Individual, as per PHIPA s.2,means: in relation to personal health information, the individual, whether living or deceased, with respect to whom the information was or is being collected or created.
Information practices, in relation to a researcher, means the policy of the researcher for actions in relation to health data or personal health information, including the administrative, technical and physical safeguards and practices that the researcher maintains with respect to access, use, retention and disposal of the information.
Personal health information as per PHIPA s.4 means identifying information about an individual in oral or recorded form, if the information, (a) relates to the physical or mental health of the individual, including information that consists of the health history of the individual’s family, or (b) relates to the providing of health care to the individual, including the identification of a person as a provider of health care to the individual.
PHIPA means the Personal Health Information Protection Act, 2004 S.O. 2004, c. 3, Schedule A
Researchas per PHIPA s.2, means: a systematic investigation designed to develop or establish principles, facts or generalizable knowledge, or any combination of them, and includes the development, testing and evaluation of research. Research includes statistical analysis.
Research Ethics Board as per PHIPA s.2, means a board of persons that is established for the purpose of approving research plans under section 44 and that meets the prescribed requirements. The Research Ethics Board at CHEO will conduct reviews of research plans submitted under this Application Form.
Use, as per PHIPA s.2, in relation to health data or personal health information means to handle or deal with the information, including by researchers who are employees or are similarly affiliated with CHEO or BORN, but does not include to disclose the information. Use, as a noun, has a corresponding meaning.
STEP 4 – Tell us about your idea for using the data – we want to help you succeed, but we need information about your project!
  1. Project title:
  1. People working with you on the project (co-investigators)
  1. Type of Project:

____ Research

____ Quality Improvement/Assurance

____ Policy Development

____ Program Evaluation

____Surveillance

____Other (describe) ______

  1. We require a written protocol for review that includes:
  • Objectives or hypothesis
  • Background/rationale
  • Methods
  • Population or cohort (inclusions and exclusions)
  • Sample size
  • Project design and timelines
  • Analysis plan*
  • Team members involved
  • Data elements requested and years of data needed (from the shopping cart on the bornontaro.ca website)
  • Any linkage to external datasets and rationale

*If BORN is doing the analysis – it is best to provide a summary of the tables you would like to have populated

Step 5 - Research Ethics Board Approval

Before the use or disclosure of health data for research purposes, a researcher must submit a copy of the decision of a Research Ethics Board that approves the research plan. If you are doing research, this applies to you. BORN will accept an REB approval for any accredited REB

____ I have an REB approval and it is attached

____ I plan to seek REB approval and will provide it

____ I do not require REB approval for this project

STEP 6 – BORN Processes the Application and Discusses De-Identification

Approximate timeline after BORN receives application

  • Estimate of cost and timing is discussed with the applicant
  • All record-level data applications are reviewed by a committee that meets once/month
  • Decision of committee is discussed with applicant
  • If decision is to proceed, a more accurate timeline can be discussed with the applicant. The complexity of the request/analysis is what determines the timeline.
  • Preparing a dataset: On average, it takes about 6-8 months for the steps: opening of file, iterative de-identification process, preparation of the dataset, getting a research agreement signed with the researcher’s organization.
  • Doing the analysis: The timeline for this will depend on the complexity of the analysis and the type of analyst required for the work. Don’t forget to budget time for back-and-forth meetings of your research team with the BORN analyst.

What Does De-Identification Mean and How Does it Apply to Me?

BORN follows best practices to reduce any risk of re-identification of individuals in a dataset. Did you know that removing names or health insurance numbers is not enough to de-identify a dataset? There are many quasi-identifiers in the BORN data and when geography is combined with these quasi-identifiers, it can make someone more identifiable. Good examples of quasi-identifiers include dates and locations of events. While we know that the vast majority of researchers would never attempt to re-identify anyone, we need to have protections in place to prevent harm in case a dataset is mishandled, stolen, or somehow falls into the wrong hands. For that reason, we use software to help us de-identify data.
What does this mean for you? Our de-identification software runs an algorithm against the quasi-identifiers in the dataset you request. It provides an objective risk of re-identification. We have a threshold for this risk and can work with you to reduce the risk and still provide you with useful data. For example, many people want exact dates (maternal or baby date of birth, date of admission etc). It will reduce the risk considerably if we change maternal DOB to age at time of birth, and preferably in intervals (e.g. 35-39). Postal code is incredibly identifiable. If you can manage a higher level of aggregation such as dissemination area, that works better!
When you are choosing variables for your work, think about how they will be presented in the final tables – if you intend to group data, then asking for groupings will help to reduce your risk. We’ll work together iteratively to help de-identify your data, but try and give you what you need to accomplish your task.

Step 7 - Complete your request and send it to:

BORN Ontario Application Form for Access to Health Data for Research – December 2015Page 1of 4