Secondary-Use Request After the Data Steward Departs
A regional research consortium of six hospitals and two community clinics maintains a 4.2-million-patient EHR-derived research data warehouse. The data use agreement names the academic medical center as the data controller, but a new industry partner requests patient-level records for a sepsis biomarker study, including admission dates and ZIP codes. The consortium's data steward retired last month; no deputy was named. Two sites have already signed the sponsor's contract, which permits the sponsor to retain data for 10 years and to share with affiliates. The registry's metadata catalog lists 1,340 variables, 212 of which lack a defined owner or source-system lineage. A site informaticist reports that the sepsis cohort query was developed locally and has never been validated against chart review. The governance committee meets in five days and must decide whether to approve the request, approve with conditions, or decline. The sponsor's timeline requires an answer at that meeting.
1. Which governance deficiencies in this setup are blocking approval, and which can be handled with conditions? Justify each classification.
Read the worked answer
Blocking deficiencies are those that prevent the committee from knowing who may authorize the use and what use is permitted. First, there is no accountable data steward or deputy, so no one can sign an attestation that the requested use is consistent with the consortium's agreements. Second, two sites have signed the sponsor's contract, creating obligations that may conflict with the consortium DUA; until legal review establishes which instrument governs, releasing data would be unauthorized. Third, the sponsor's 10-year retention and affiliate-sharing terms are broader than most consortium DUAs permit; this is potentially curable by amendment, so it is conditional rather than absolutely blocking. Fourth, 212 variables lack owner and lineage; if the requested sepsis variables are among them, provenance cannot be attested. That is blocking for those variables but can be cured by restricting the request to variables with documented lineage. Fifth, the sepsis phenotype has never been validated; this does not block governance approval in principle, but it blocks any release intended to support mortality or biomarker claims until a validation report exists. Dates and ZIP codes are not automatically blocking, but they require either a limited data set with a DUA or an expert-determination analysis. The committee should separate 'cannot decide today' from 'approve with named conditions' rather than treating every gap as fatal.
2. Draft the specific conditions and minimum documentation you would require before any patient-level data leave the consortium.
Read the worked answer
Conditions should attach to authority, scope, security, and evidence. Authority: appoint an interim data steward and deputy in writing, with delegated signatory authority recorded in the minutes; obtain legal review confirming that the sponsor contract conforms to the consortium DUA or is amended. Scope: limit the request to the minimum variables needed for the sepsis biomarker analysis; provide a variable-level data dictionary listing source system, owner, lineage, and transformation for each requested field; remove fields that cannot be traced. Privacy: use a limited data set with a DUA or complete an expert-determination assessment; prohibit re-identification and linkage to external files; require sponsor affiliate sharing to be approved separately or removed; set retention at three years with certified destruction. Evidence: require a phenotype validation report using chart review of at least 100 admissions, with positive predictive value and sensitivity reported; require a pre-specified analysis plan. Security: encryption, access logging, incident notification within 30 days, and return or destruction certification. Documentation to retain: intake request, risk assessment, legal review, DUA, data dictionary, validation report, committee minutes, access logs, and any dissent. Approval should be time-limited and re-reviewed after validation.
3. Two sites have already signed the sponsor's contract, and there is no sitting steward. What operational sequence do you recommend for the five-day window?
Read the worked answer
Do not let the sponsor's deadline convert an authority gap into an approval. On day one, the committee chair should appoint an interim steward in writing and notify both sites and the sponsor that all data transfer is paused pending governance review. On day two, legal counsel should compare the sponsor contract with the consortium DUA and master agreement, focusing on retention, affiliate sharing, publication rights, and breach notification. On day three, the committee should decide whether the two sites can be brought under a consortium addendum or whether their data must be excluded from this request. If the sponsor will not accept conforming terms, exclude those sites rather than release under conflicting contracts. On day four, document the decision, including any dissent, and notify site privacy officers and IRBs as required. On day five, give the sponsor a written conditional approval or decline with specific reasons and a path to cure. Operationally, this preserves the relationship while preventing an irreversible transfer. The interim steward should also open a corrective action plan for steward succession and metadata ownership so the same gap does not recur.