Attachment 7 SOP for Research Requests DART.docx

STANDARD OPERATING PROCEDURE

Processing Requests in the Data Access Request Tracker

February 2020

Revision History

Document Title: STANDARD OPERATING PROCEDURE Processing Requests in the Data Access Request Tracker (DART)

Table of Contents

STANDARD OPERATING PROCEDURE (SOP) Processing Requests in the Data Access Request Tracker

PURPOSE

This Standard Operating Procedure (SOP) establishes the process/procedure for approving Data Access Request Tracker (DART) Requests.

DEFINITIONS

· DART: A workflow application that guides data users through the process of requesting access to data and guides reviewers through the review process. It collects and retains required information and documents, submitted by the requestor and makes them available to the appropriate reviewers. Reviewers receive notifications with links to the request to be reviewed and can approve them or request additional information or actions from projects. Email notices from reviewers are sent automatically to the requestor at each stage of the review process.

· Detailed Review: Controls the process for obtaining detailed reviews/approvals from representatives from the following areas: VHA Security, VHA Privacy, Office of Public Health, Office of Research & Development (ORD), Homeless Registry and Compensation and Pension Record Interchange (CAPRI)/Joint Legacy Viewer (JLV).

· Final Review: Controls the work flow needed to ensure that requests have been approved by detailed review and can be given final approval and moved on to provisioning of the access or data.

· Initial Review: Controls the work flow needed to ensure that requests have been submitted with correct documentation and can be moved on to detailed review.

RESPONSIBILITIES

· VHA National Data Systems (NDS):

· NDS will perform initial review and approve.

· NDS will determine requirements and need for detailed review(s).

· NDS will perform final review and approve.

· NDS will provision access of VSSC and MCA Web Reports.

· NDS will provision access of CAPRI/JLV after VHA Privacy Office received

· VINCI Data Managers

· VINCI Data Managers will provide a data extract upon notification that NDS has given final approval.

PROCEDURES

1. Accessing DART Reviews

1. Log into DART: https://dart.vha.med.va.gov/vinci_dart_client/dart9/dashboard.html NOTE: If you receive an “error loading To-Do List” message, perform a hard refresh on the browser: Ctrl F5

2. Click on your “To-Do-List”, then click the Research tab NDS initial reviewer will utilize the DART NDS “To-Do List” for selecting which requests to attend to first. NDS reviews requests on a “First come, first serviced” basis.

2. Initial Requests

1. Once you click on the link to the request, under the “Information” tab, review:

· Approval Expiration Date and the Anticipated Study Close Date. Some protocols will not have an Approval Expiration Date because they are exempt from IRB continuing review.

· The selections under Exemptions and Informed Consent*

· The selections under HIPAA Authorization*

2. Click on the “History” Icon at the top right of the screen to review if the request has ever been seen by an NDS Initial reviewer.

· If it has, and was sent back to the submitter for changes, click on the “Communication” Icon to see what changes were requested and if the submitter included additional information or asked questions.

3. Navigate to the “Participants” tab to review:

· Name and # of participants (this information will need to be cross checked against required documentation, specifically the Research Request Memo)

· Whether the participant is listed for Notifications only, Data Access or both

· Whether any participants are listed for CAPRI/JLV Access

· The number of locations involved in the study

4. Navigate to the “Data” tab to review:

· The data sources being selected (this information will need to be cross checked against required documentation)

· Note storage location. If storing locally, a Security review is required.

· If Real SSN is selected, note that an ORD review is required.

· If Yes is selected for “Will data be transferred external to the VHA?” (DUA is required), note that a Security review is required.

· VSSC and/or MCA Web Reports Mainframe access (provisioned by NDS Reviewer when the final request is approved)

· Mainframe access (Ask requestor to de-select Mainframe checkboxes)

· If CAPRI/JLV is selected (and new CAPRI request forms are included in the ‘Documents’ tab), a Privacy, ORD, and CAPRI/JLV review is required.

· If Homeless Registry is selected, Homeless Registry review is required.

5. Navigate to the “Documents” tab to review:

· Review all documents submitted and identify any deficiency using the DART “Add Note” communication tool associated with each document. BE AS SPECIFIC AS YOU CAN and avoid using acronyms.

· Reviewer will set the “Review Status” to Pending, Under Review, Waiting for Information, or Complete as appropriate.

· For each document, the Reviewer will need to look for the following:

· Research Request Memo

1. Check data sources described on the Memo to ensure they match those listed on the data sources tab in the DART application

2. Check to ensure that the participants listed match those listed on the Participants tab requiring Data Access (remember, those only listed for notifications are not required to be listed)

i. Ensure participants are designated as VA Employees, WOC or Contractors

ii. If Requiring VSSC and/or MCA Web Reports, NT username and domain are needed to provision access. Requestors must also list the web products that will be accessed.

3. Ensure the Description has been completed as to why they are requesting access.

4. Make sure security questions about data transfer and storage are answered for Security Review. These questions are required if the Requestor will be storing the data outside of the VINCI environment locally.

5. Check signatures. Ensure the following have signed

i. Principal Investigator

ii. Supervisor

6. Note any deficiencies using the DART “Add Note” communication tool

· Research Study Institutional Review Board (IRB) Approval letter

1. Ensure the name of the protocol indicated in the letter is the same as the Official Name, or Short Name in the Information section of the request. NOTE: Once the requester submits the request, they are no longer able to edit the Proposed Protocol Name. If a change is required, email Tim Trautman and Grant Larimer to request the change to that field.

2. Check expiration date (Note: If no expiration date is indicated and the date of approval on memo is within the year, it is okay. Exempt studies will not have an expiration date. This should be reflected in the Information section). If the IRB date is close to expiration, you can send the requestor a note as an FYI to be sure they come back and upload a new IRB letter. The IRB expiration date on the letter should match with the Approval Expiration Date (or lack thereof) in the Information section.

3. Note any deficiencies using the DART “Add Note” communication tool

· Research and Development (RD) Committee Approval Letter

1. Check document is uploaded and no expiration date is indicated. (Note: For IRB exempt studies, sometimes the expiration date in the Information section will be the R&D Expiration date.

· IRB Approval of Waiver of HIPAA – Compliant Authorization

1. Check to ensure proper document is loaded

2. If CAPRI/JLV is a data source:

i. Determine if a mention of CAPRI is present and/or required. Waivers that indicate specific data sources (like CDW) must also indicate the need for CAPRI/JLV access. Waivers without specific data sources do not. However, CAPRI/JLV must be mentioned in either the Waiver or Protocol if specific language is not mentioned in the HIPAA Waiver of Authorization

3. Note any deficiencies using the DART “Add Note” communication tool *Multisite studies can go through the Central IRB, but it is not required.

· Research Protocol

1. Search the document to locate data sources being requested

2. If CAPRI/JLV is a data source:

i. If CAPRI/JLV is not mentioned in the HIPAA Waiver, make sure it is mentioned in the protocol.

3. Note any deficiencies using the DART “Add Note” communication tool

· CDW Domain Checklist

1. Check to ensure the Checklist has either CDW Production or CDW Raw domains selected. Those selected must match those checked on the data sources tab in the DART application in the CDW section.

2. Note any deficiencies using the DART “Add Note” communication tool

· Real SSN Access Request

1. Ensure correct document is loaded

2. Note any deficiencies using the DART “Add Note” communication tool

· VASQIP Cardiac and Non-Cardiac Domain Checklists

1. Ensure correct documents are loaded (Only if Veterans Affairs Surgical Quality Improvement Program (VASQIP) is selected under Other Data in the Data Sources section)

2. At least one of the checklists must have domains selected. If one of the checklists is left blank, add a comment that none of these domains are being requested

· Study Participants Documentation

1. Vital Status Rules of Behavior (VS ROB)

i. Ensure document is loaded.

ii. Make sure document is signed by the participant. Note: When Vital Status is being requested all participants must sign a VS ROB regardless of individual need for Vital Status data as this information is rolled up into the VINCI extract file.

2. EHR Access Request Form

i. Ensure a document is loaded (will only be uploaded if CAPRI/JLV is requested).

ii. Ensure the EHR forms are signed by the Requestor, Principal Investigator and Approving Authority.

iii. Save the form on the Q drive in the HIA Request Scan folders

3. Note any deficiencies using the DART “Add Note” communication tool

6. Responding to Requestor with Changes

· NDS initial reviewer will notify the requestor of any deficiencies in the documentation and what changes are required by using the “Request Changes” function in DART. Notes from the review should be copied and pasted into the “Request Changes” communication box.

3. Change Requests Requests that come back can either be Initial Reviews or Amendments

1. Review the Information on the “Information” tab

2. Review the communications and amendment narrative

3. Review the history tab

4. Check that all changes that were requested have been made

5. If some or all changes were not made, request changes again.

4. Amendments

1. Amendment Narrative needs to contain information on new staff, new data sources, and other changes being requested.

2. Check Approval Expiration Date and make sure the IRB documents match

3. Look at Participants tab

4. Look at Data tab

5. Documents – Scroll to ensure all are complete. If something is marked as No Status, review. If good, mark complete

i. Updated Memo describing changes and with updated signatures

ii. If requesting Vital Status and/or CAPRI/JLV – additional documentation should be uploaded for each new participant

6. Send to Privacy. If new CAPRI/JLV requests are included and HIPAA or Protocol documentation has changed, send to ORD and CAPRI/JLV review as well. If new CAPRI/JLV requests are included and HIPAA or Protocol documentation has not changed, send to Privacy and ORD. If changes have been made to the local server or DUA, send to Security review also.

5. Sending for Additional Reviews Upon satisfactory initial review NDS initial reviewer will determine what detailed reviews are required and select the appropriate review on the “NDS Decision” Tab of DART and approve the initial review. Please see DART Review Flow Chart on Appendix A for additional information.

New and Change requests:

· Privacy – Always reviews

· Security – If storage location is outside VINCI or DUA is required

· ORD – If Real SSN is requested

· Homelessness – If requested

· CAPRI/JLV – If requested (See Appendix A for more details on this review process)

Amendments:

· Privacy – Always reviews

· Security – If storage location is outside VINCI or DUA is required and Security has not approved a previous amendment (check previous amendments in History to find if the review has been completed before)

· ORD – If Real SSN is requested and ORD has not approved a previous amendment

· Homelessness – If requested and Homeless Registry has not approved a previous amendment

· CAPRI – If requested and changes have been made to the HIPAA Waiver or Protocol

6. Complete NDS Final Review

1. NDS final reviewer will utilize the DART NDS “To-Do List” for selecting which requests to attend to first. NDS reviews requests on a “First come first serviced” basis.

2. NDS final reviewer will verify that all detailed reviews have been completed using the “History” function of DART.

3. NDS final reviewer will re-review any documents that have been replaced as indicated by a change of the status associated with each document.

4. NDS final reviewer will notify the requestor of any deficiencies in the documentation using the “Request Changes” function in DART.

7. Provisioning Access

1. NDS final reviewer must provision access for VSSC and MCA Web Reports in NSSD (See HCO SOP for NSSD provisioning details). They should also send a notification email to the participant(s) approved for VSSC/MCA, copying the PI, submitter (indicated in the history section) and Betsy Lancaster

2. NDS final reviewer must provision CAPRI and JLV Access in HIA Registry. NOTE: A CLAIMS account must be created for Research users requesting JLV access whether or not they have a CPRS account. See Appendix A for more details.

3. VINCI Data Managers receive a DART generated message that final approval has been given. They work with the requestor to generate a data extract that complies with the approval received. The extract can be used in the VINCI environment or on VA servers that are behind the VA firewall.

Appendix A:

CAPRI and JLV Research Requests

The CAPRI/JLV reviewer in the VHA Privacy Office, Andrea Wilson (Andrea.Wilson3@va.gov), does not work in DART every day, so NDS sends an email notification to her when there are CAPRI/JLV reviews for her to complete.

This is the current process:

1. When a protocol requests new CAPRI/JLV access it is added to the DART Request Tracking spreadsheet by the NDS reviewer in the “In Process” tab.

· Include DART Tracking #, Protocol Name, names of participants requesting CAPRI and/or JLV, and the location of language about CAPRI/JLV in either the HIPAA Waiver or Protocol (in the Recommended Approval column).

2. Periodically, after requests have received Privacy and ORD approval, an email is sent to the VHA Privacy Office asking for approval. The email includes the DART Tracking Number, Research Protocol name and Recommended Approval from the spreadsheet.

3. Once the CAPRI/JLV reviewer has approved requests in the CAPRI/JLV review queue she will send an email saying she has approved. Assuming all other reviews are complete, the request will come into the NDS to-do-list for Final NDS Approval.

4. CAPRI and/or JLV access should then be provisioned in HIA Registry and tracked in Alexsys. A notification email should also be sent to the users approved.

· User Information from the EHR Access Request Form to include in the HIA Registry:

· Help Desk Ticket (the Alexsys ticket number)

· Name

· SSN and DOB (if not included on the form email asking them to call you to give you their SSN and/or DOB)

· User Group and Service/Section: Research

· Systems Authorized

· Purpose for Access: Research

· Level of Access

· Title and Division

· Office Phone and Email Address

· Access Expiry Date (if applicable)

· “Research Protocols” Name

· User training - Pull up the user’s training dates by using Manage Users in HIA Utilities and reviewing the Training Information from TMS. Update training by clicking Info Sec and Privacy buttons in Utilities. The training dates will update in HIA Registry simultaneously. If the user’s training does not pull up automatically, contact user, and request certificates of completion for the required trainings. Upload the certificate(s) onto the Q drive HIA Request Scan folders, and manually enter the training dates. Enter a note into the comments tab in HIA Registry indicating training dates were updated manually.

· Create the CAPRI\JLV Account

· Hit Make Account button in the HIA Registry and follow prompts

· Change Request status from Submitted to Approved

· Ensure appropriate Sites are selected in the Sites tab in the HIA Registry

· Click on Access/Verify Codes in General tab to send user their codes

· Send Notification email to the Participants granted access to CAPRI/JLV, the Principal Investigator and any Study Coordinators. Include the name of the Protocol, the DART tracking number, and

· Complete Alexsys ticket

· Create new ticket. Select Access Request as the Work Request Type. Select Access Request Form as Type of Fax or Email.

· Include DART tracking number, user(s)’s name in the Title.

· Include Protocol Name in the Description section.

· Make the Purpose of Use Research

· Choose the System (CAPRI and/or JLV), Date Completed Form Submitted to NDS and Access Duration. Access Duration should match the date on the EHR Request Form and/or in the Information section of the DART request.

· Put number of Users Requested and Users Approved (these will usually match and should be consistent with how many users were approved for CAPRI/JLV)

· Change status to Closed and Save.

Email Notification template:

· You can remove JLV if not requested on the EHR form image1.wmf image2.png image3.png image4.png image5.png image6.png image7.png image8.png image9.tmp image10.png image11.png image12.png image13.png