Healthcare Cost and Utilization Project Data Use Agreement
Course
Whatever ... I see or hear... which ought not to be spoken of abroad, I will not divulge, as reckoning that all such should be kept secret. Hippocratic Oath, circa 4th Century B.C.
When all is said and done, will our healthcare records be used to heal us or reveal us? ~Donna Shalala, Former U.S. Secretary of Health and Human Services. Protecting the privacy of the individuals and institutions that are featured in your healthcare research is imperative. The Healthcare Cost and Utilization Project (HCUP) Data Use Agreement safeguards the confidentiality of patients, physicians, and healthcare institutions. Contents:
Welcome to the Healthcare Cost and Utilization Project (HCUP) Data Use Agreement (DUA) Training!
HCUP databases offer a national information resource of discharge-level healthcare data. Because of the sensitive nature of health data, this information must be safeguarded to protect the privacy of individuals and institutions. The purpose of this course is to:
The goal of this course is to explain important requirements in the HCUP Data Use Agreement. HCUP Data Use When working with healthcare information, researchers have a responsibility to maintain the privacy rights of the individuals and institutions featured in their data. The proper use of HCUP databases, including strict adherence to the Data Use Agreement, will help protect the availability of this valuable data resource.
The Agency for Healthcare Research and Quality (AHRQ) is a Federal agency within the Department of Health and Human Services. AHRQ's mission is: "To produce evidence to make health care safer, higher quality, more accessible, equitable, and affordable, and to work within the U.S. Department of Health and Human Services and with other partners to make sure that the evidence is understood and used."
To accomplish this goal, AHRQ supports a broad base of healthcare research. AHRQ also sponsors the Healthcare Cost and Utilization Project (HCUP).
HCUP data are a valuable resource for the healthcare research community. It is vital to maintain a balance between protecting data privacy and securing the use of data in national healthcare research. Strict adherence to the HCUP Data Use Agreement (DUA) ensures the long-term viability of HCUP. Violations of the DUA could force AHRQ to discontinue providing public release versions of the data.
You must sign a Data Use Agreement and complete the online Data Use Agreement Training Course at www.hcup-us.ahrq.gov before you are given access to HCUP data. The DUA is a legally binding agreement with AHRQ that defines how you can use HCUP data. The DUA covers the following topics: Individual responsibility Your signature on the DUA acknowledges that:
Governing regulations Each participating data organization that contributes data for HCUP databases has its own policies and governing regulations on data use and handling. The provisions outlined in the DUA reflect the requirements contained in legal Memorandums of Agreement (MOA) between each contributing data Partner and AHRQ. Consequences When you sign the DUA, you agree to comply with the requirements listed. If you violate the DUA, the following consequences may occur:
HCUP data contain discharge-level information on inpatient, ambulatory surgery, or emergency department care in U.S. hospitals. For confidentiality purposes, all data elements that directly identify an individual have been removed.
However, through deliberate and sophisticated technical analysis, it might be possible to ascertain the identity of particular persons. This would be considered a violation of the HCUP DUA. The HCUP DUA prohibits users from making any effort to determine the identity of any person contained in the data, including patients, physicians, and other healthcare providers. Risk of individual identification is increased under certain circumstances. Under the HCUP DUA, you are prohibited from releasing, disclosing, publishing, or presenting any individually identifying information obtained from the data. It is also your responsibility to prohibit anyone else who has access to HCUP data from identifying individuals within the data.
Protection of Individual Identities DUA Excerpt 1 "I will not release or disclose information where the number of observations (i.e., individual discharge records) in any given cell of tabulated data is less than or equal to 10. The publication of values of 1 to 10 is prohibited in text and tables." Protection of Individual Identities DUA Excerpt 2 "I will not release or disclose, and will take all necessary and reasonable precautions to prohibit others from releasing or disclosing, any information that directly or indirectly identifies persons. This includes attempts to identify individuals through the use of vulnerability analysis or penetration testing." Protection of Individual Identities DUA Excerpt 3 "Methods that could be used to identify individuals directly or indirectly shall not be disclosed, released, or published.quot; Sara: "Hi Donna. How is your research report coming along?" Donna: "Great. I am using HCUP data to study a rare medical condition, Kawasaki's disease, in children. In certain counties or geographical areas, the incidence of the condition reveals only one or two cases of the disease in a given year. I would like to publish these findings and include a table recording the incidence of the disease for these areas. However, within the table there will be cell sizes less than or equal to 10. Can I get an exception for this restriction and publish it with these smaller cells?" Narrator:"Can Donna publish her findings of the incidence of Kawasaki's disease?" Choose the best answer.
Return to Contents
Depending on the policies and laws of the State providing the information, HCUP data may include the identities of hospitals and other health institutions. The identities of these institutions are made available for research purposes but must not be disclosed directly or indirectly, through publication or any other means.
Hospital-level analysis is permitted, but findings must be aggregated in a way that ensures no individual facility is identifiable. Institutions cannot be identified directly or indirectly in any disseminated materials. Restrictions on Hospital Identification DUA Excerpt "I will not publish or report, through any medium, data that could identify individual establishments directly or by inference." Return to Contents
As someone who works with confidential information, you should know what you can and cannot do with it. You are responsible for how you and others in your research group use the HCUP data to which you have access.
Narrator: "Tom has just purchased HCUP data and is eager to begin his research project. He plans to collaborate with a few colleagues at his university and also plans to have John, a programmer at another institution, run some of the analyses." John: "I want to get started on this analysis. Can you just send the data file to me?" Tom: "As the data purchaser, I am responsible for the security of the data files, so I want to be careful about following all the requirements of the HCUP Data Use Agreement" Narrator: "What steps does Tom need to take before he can share the HCUP data with John and his other colleagues? (Choose all that apply)."
Return to Contents
Use of confidential data can be a complicated process. We want to help you avoid inadvertent violations of the HCUP Data Use Agreement. Certain restrictions on the use of HCUP data exist to prevent the violation of individual and institutional privacy rights.
Lisa: "Lakeview Hospital. This is Lisa speaking." Stephen: "Hi Lisa, my name is Stephen Gossling. I am a healthcare researcher with Burnside University. I am using HCUP data to research the prevalence of newborn respiratory illnesses within the western United States. I have some questions about your data on newborn respiratory illness and would like to verify the number of cases that were admitted to your hospital 3 years ago." Narrator: "Which of the following is a violation of the HCUP DUA? (Choose all that apply)."
Return to Contents
The HIPAA Privacy Rule sets national standards for patient rights with respect to health information. This rule protects individually identifiable health information by establishing conditions for its use and disclosure by covered entities.
Further information on the HIPAA Privacy Rule can be found at www.hhs.gov/ocr/hipaa or http://privacyruleandresearch.nih.gov/. Return to Contents
AHRQ and its HCUP Partners must demonstrate that HCUP data are used to generate significant research contributions. Therefore, it is crucial to properly cite and acknowledge AHRQ and the specific HCUP databases used in your publication.
Suggested citations for HCUP databases and tools can be found on the HCUP-US website. Remember, HCUP data may not be shared with anyone outside the members of your research group who have signed the HCUP DUA and taken this training. Other researchers interested in replicating your work should be directed to the publicly available files on HCUP-US. Publishing Recommendations DUA Excerpt I will acknowledge in all reports based on these data that the source of the data is the "[cite specific database], Healthcare Cost and Utilization Project (HCUP), Agency for Healthcare Research and Quality." Return to Contents
During this course, you have learned the importance of adhering to the regulations outlined in the Data Use Agreement, which benefits patients and healthcare providers, AHRQ, HCUP data Partners, and you.
HCUP and AHRQ HCUP is a family of healthcare databases and related software tools and products developed through a Federal-State-Industry partnership and sponsored by the AHRQ. HCUP data contain confidential information describing the clinical condition of individuals and the medical care received. It is essential to provide safeguards for such data in order to protect the privacy of individuals. This emphasis on protection also helps to ensure that HCUP data remain available for future healthcare research. Importance of Adherence It is important for you to understand the confidential nature of HCUP data and what you can and cannot do with it. Everyone given access to the HCUP data must sign a DUA, which outlines how the data may be used, and complete the online Data Use Agreement Training Course at www.hcup-us.ahrq.gov/tech_assist/dua.jsp. Civil or criminal penalties will be enforced for anyone who violates the requirements of the HCUP DUA. Protection of Individual Identity
Hospital identification is available in many State-level databases for research purposes. Do not publish or disclose directly or indirectly the identity of these institutions. Appropriate Use of Data You are responsible for how you and others use the data to which you have access. You may:
You are prohibited by the HCUP DUA from:
The HCUP DUA is consistent with HIPAA requirements for use of a limited data set. Publishing Recommendations It is important that you properly acknowledge AHRQ and the specific databases used in your publication. In addition, researchers interested in replicating your work should be directed to the publicly available files on HCUP-US. Return to Contents
Congratulations! You have completed the HCUP Data Use Agreement course.
This course has discussed the key elements of the Data Use Agreements (DUAs), but does not include every requirement. Please read the DUA thoroughly before signing it. The HCUP DUAs can be accessed on the HCUP-US website. You only need to take this course once. If you obtain or use additional HCUP data in the future, you will be required to sign another DUA, but you will not need to complete this course again. Data purchasers: If you are purchasing HCUP data, use the unique certification code to enable your Account in the online HCUP Central Distributor. You will be required to execute the DUA electronically during the ordering process. Others with access to HCUP data: The training certification code and signed DUA for collaborators or others with access to HCUP data under the primary purchaser's agreement should be submitted directly to the HCUP Central Distributor to authorize your use of the data. Send to: Email: HCUP@AHRQ.gov It is highly recommended you print this certificate and keep it for your reference, as you may be asked to submit a copy to verify completion of the course. To verify you have completed the course, type your here , then select the link to print your certificate. For the best results please print the certificate in landscape orientation. Print Certificate. Important! Make note of your certification code: HCUP- found on your certificate. Save your certificate for your records. Make sure your completion certificate saves correctly before you close this course. This is your only chance to save this certificate. If you are having difficulty with this course, please contact HCUP Technical Assistance staff at hcup@ahrq.gov for assistance or call (toll-free) 1-866-290-HCUP (4287). Return to Contents Answers
4. Protection of Individual Identities: Scenario 1
Question 1 = c. No, this would be in violation of the HCUP DUA. The HCUP DUA stipulates that all published results must be reported with cell sizes greater than 10. One or two cases of a rare medical condition in a given geographic area are too few to report while preserving confidentiality. Cell sizes fewer than or equal to 10 could inadvertently reveal identity. These cases will need to be reported by combining the geographic areas up to a cell size greater than 10. Report only counts of 11 or more. To return to Section 4, Return to Section 4 Return to Contents Answers
6. Appropriate Use of Data: Scenario 2
Question 1 = a. Each of his colleagues must complete the online Data Use Agreement training course. b Each of his colleagues must read and sign the HCUP Data Use Agreement c Tom must send the online training completions certificates and signed DUAs for each of his colleagues to the Central Distributor and d Tom must ensure that the data is kept in a secured environment and that only authorized users will have access to the data. HCUP data may be shared, but the original data purchaser is responsible for ensuring that the data are secure. Physical media must be kept in locked storage; data may be stored on secure servers at your institution as long as access is restricted to authorized data users. Only authorized users who have completed the online Data Use Agreement training, signed the Data Use Agreement, and submitted those documents to the HCUP Central Distributor may have access to the data. To return to Section 6, select this link: Return to Section 6 Return to Contents Answers
7. Data Use Restrictions: Scenario 3
Question 1 = a. Contacting an institution to question, verify, or discuss HCUP data b. Identifying individuals within HCUP data Stephen's actions are in violation of the HCUP DUA. Stephen cannot contact an institution to question, verify, or discuss HCUP data or to identify individuals within the data. However, Stephen can link HCUP data to additional data sources, such as the Health Resources and Services Administration's Area Resource File. Stephen may also benchmark his results from HCUP data to another data source. To return to the Section 7, select this link: Return to Section 7 Return to Contents
Resources
Helpful Links: Clicking on these links will open a new window.
This course may not be copied, photocopied, reproduced, translated, transmitted, or electronically converted in whole or in part without the prior written consent of the Agency for Healthcare Research and Quality (AHRQ).
|
| Internet Citation: DUA Training - Accessible Version. Healthcare Cost and Utilization Project (HCUP). April 2021. Agency for Healthcare Research and Quality, Rockville, MD. www.hcup-us.ahrq.gov/DUA/dua_508/DUA508version.jsp. |
| Are you having problems viewing or printing pages on this website? |
| If you have comments, suggestions, and/or questions, please contact hcup@ahrq.gov. |
| Privacy Notice, Viewers & Players |
| Last modified 4/26/21 |
Email Updates