Subject: Confidentiality and Release of Data

Missouri Cancer Registry

Policies and Procedures – Data Analysis and Reporting

Subject: Confidentiality and Release of Data /
Function: Data Analysis and Reporting / Revised
12/15/05; 10/31/06

OBJECTIVE: To maintain patient confidentiality while providing release of data for research.

DEFINITIONS:

Confidential Data: Patient-specific data and any information that specifically identifies a health care professional or institution. In addition, information that characterizes the caseload of a specific institution or health care professional is considered proprietary and confidential.

POLICY: The Department of Health and Senior Services (DHSS) has an extensive policy on confidentiality and security of health information that includes explicit instructions on release of client information. The MCR has adopted DHSS policy 11.17, and staff will adhere to that policy in lieu of any policy previously used by the Registry.

Procedures:

1.  MCR will follow procedures set forth by DHSS.

2.  MCR may release confidential information to health care providers and institutions directly involved in the care of the patient (e.g. a physician requests a list of patient he or she treated for breast cancer).

3.  MCR does not handle media calls. Media are referred to DHSS.

4.  MCR will follow standard cell-suppression procedures in summary data.

5.  MCR will refer callers (research or public) to the MICA website to obtain data files of non-confidential data.

6.  Researchers must request data in writing.

7.  Research protocols may go through the University of Missouri Health Care’s IRB and/or the DHSS IRB.

REFERENCES:

NAACCR Standards for Cancer Registries Volume III, 4.1.1, Confidentiality Policies and Procedures: Issues in Research, Reporting and Release of Registry Data

Approved:

______

Subject: Requests for Information/Data
Function: Operations / Revised
11-06-06

OBJECTIVE: To provide procedures to inform MCR staff how to handle requests for data from various sources (media, public, researchers, hospitals, etc.).

DEFINITIONS:

POLICY:

PROCEDURE: External requests for information should go to the Project Manager or the Research and Data Unit Coordinator. Requests from reporting facilities

REFERENCES:

Policy

NPCR Program Standards.

Approved:

______

Subject: Data Release - see more at end of document /
Function: / Revised
11-06-06

OBJECTIVE: To ensure that access and disclosure of MCR data is in accordance with guidelines set forth in the Missouri Cancer Reporting legislation.

DEFINITIONS:

POLICY: MCR staff will …… HIPAA…

Within 12 months of the end of the diagnosis year with data that are 90% complete, the central registry produces preliminary pre-calculated data in tables in an electronic data file or report of incidence rates, counts, or proportions for the diagnosis year for the Surveillance Epidemiology and End Results (SEER) site groups.

Within 24 months of the end of the diagnosis year with data that are 95% complete, the central registry produces preliminary pre-calculated data in tables in an electronic data file or report. The report includes, at a minimum, age-adjusted incidence rates and age-adjusted mortality rates for the diagnosis year by sex for SEER site groups, and where applicable, by sex, race, and ethnicity.

The central cancer registry, state health department, or its designee uses registry data for planning and evaluation of cancer control objectives in at least three of the following ways in the past year:

·  Comprehensive cancer control.

·  Detailed incidence/mortality estimates

·  Linkage with a statewide cancer screening program to improve follow-up of screened patients.

·  Health event investigation(s).

·  Needs assessment/program planning.

·  Program evaluation.

·  Epidemiologic studies.

·  Data Monitoring

The central cancer registry annually submits a data file to the NPCR-Cancer Surveillance System (CSS) that meets the reporting requirements outlined in the NPCR-CSS Submission Specifications document and meets criteria for publication in United States Cancer Statistics.

PROCEDURE:

Upon completion and finalization of data for designated year, a database will be created and stored by Registry Statistician. This static database will be used whenever data related to annual report is to be analyzed. Finalized data is received from the Registry Database manager and processed as follows:

1.) The data file is processed by SAS using the program fixlen.sas in order to standardize the length of each record in the data file

2.) The data file is then processed through Bladder.sas in order to change the behavior of all bladder cancer incidences to invasive.

3.) The data file is then processed using the conversion utility ICDO2-3.exe

4.) The output file from this utility is then processed through the conversion utility ICDO3-2.exe.

5.) The resulting data file is then processed using SEER*Prep in order to create a SEER*Stat database.

·  Analysis of data for frequency data requests is to be performed Registry Statistician using the created database and SEER*Prep.

·  Analysis of data for mortality data requests is to be performed by Registry Statistician using SEER*Prep.

·  Data requests are to be reviewed by Operations Director and/or Project Manager prior to forwarding to DHSS.

REFERENCES:

Policy

NPCR Program Standards II-A-12

NPCR Program Standards II-A-11

Approved:

______

Subject: MICA and Annual Report /
Function: Data Analysis and Reporting / Revised
11-01-06

OBJECTIVE: To provide a summary and in-depth review of the data collected by the Missouri Cancer Registry.

·  To increase the usefulness of cancer incidence, mortality and behavioral risk factor data by making data available in a variety of formats and in a timely manner.

·  To increase the utilization of cancer incidence, mortality and behavioral risk factor data by cooperating and collaborating with other programs, agencies and institutions.

·  To participate in activities designed to determine and/or maintain objective standards for certification.

DEFINITIONS:

POLICY:

·  To publish 24-month hard-copy annual report containing crude, age-adjusted and age-specific cancer incidence and mortality rates and BRFSS prevalence rates for compliance with screening guidelines for breast, cervical and colorectal cancer.

·  To produce 12-month report containing crude, age-adjusted and age-specific cancer incidence rates for internal distribution only.

·  To update Internet and intranet cancer incidence MICAs (statewide, regional and county-level).

Procedures:

1.  Annually, MCR will provide a summary of central cancer registry data, to include:

·  Narrative text

·  Incidence rates (by primary site, sex, race, age group, etc.)

·  Mortality rates

·  Survival rates (?)

·  Levels used to compute rates

·  Levels used to release rates for public use

2.  The Annual Report will be published electronically on the MCR website and sent to reporting facilities.

3.  Annually, MCR will provide data to DHSS for use on the Missouri Information for Community Assessment (MICA) website.

4.  From dataset submitted to NPCR by 31 January 2007, prepare and distribute extract files for use in annual report and cancer incidence MICAs [within five working days after submission].

Responsibility of: Database Manager and Senior Health Program Specialist (MU); Research Analyst III (DHSS)

5.  Upload cancer incidence MICAs (including data from 1996 through 2004) on DHSS’s website (with link from MCR’s website to the internet MICA)

6.  Prepare 12-month report (tables only) for internal distribution only

7.  Load updated 1996-2003 and new 2004 cancer incidence data into MICA

8.  Prepare and distribute hard-copy 24-month annual report [

REFERENCES:

NAACCR Standards for Cancer Registries Volume III, Chapter 4

http://www.dhss.mo.gov/CancerMICA/index.html

Approved:

______

From Current P&P:

Public Requests for Data/Information 3.3

The majority of requests for data or information will come directly to the Department of Health and Senior Services. Should requests come directly to the MCR, the request will be handled by the Project Manager who will be responsible for communicating it to the Research Analyst III at the Department of Health and Senior Services..

Data Request Procedures

Project Manager will receive all data requests. Form will be sent to requestor for completion. Form is located at:

\\Umh.edu\data\Health_Management_Informatics\Research\Cancer_Registry\Data Request\2005\DataRequestForm.doc

Completed form will be forwarded to DHSS for approval

When the request is approved OSSIV will then number and log the request into:

\\Umh.edu\data\Health_Management_Informatics\Research\Cancer_Registry\Data Request\tracking.xls

Requests will be numbered DRYYXXX. Where YY equals the year and the next 3 are assigned sequentially; e.g. DR06001 would be the first data request for 2006.

Statistician will create the electronic version of the data request form if necessary and then perform the data request.

A folder for each data request will be created in the corresponding year file under:

\\Umh.edu\data\Health_Management_Informatics\Research\Cancer_Registry\Data Request\

This folder will contain:

The SEER*Stat .si and .sim files

An electronic copy of the data request form

An excel spreadsheet of the data request

Project Manager will create a hard copy folder containing all the hard copies of the above material in addition to any other correspondence, notes, etc concerning the data request.

Protocol for Researching Missouri Cancer Registry Data

Describe the purpose of the study or reason for the request. If data requested is record-level data, or aggregated data where an individual could potentially be identified, the data can only be used for the purpose stated below. Requestors should address study objectives, benefits to public health and anticipated outcomes.

1)  Requesting cancer incidence data (check all that apply)

Aggregate data not available on MICA

NOTE: County-level data are generally released only in multiple years to protect patient confidentiality. Case counts are suppressed for cell sizes < 6.

Record-level data without confidential identifiers

NOTE: Institutional Review Board (IRB) waiver may be required.

Record-level data with confidential identifiers

NOTE: IRB approval from Requestor’s institution, the University of Missouri and the Missouri Department of Health and Senior Services and Senior Services may be required.

2)  Address each of the following:

·  Which specific data elements are needed?

NOTE: Commonly-requested data elements are shown on the attached form.

·  What time period of events is being requested?

NOTE: For aggregate county-level data, multiple years will be required. Population-based data are available for diagnoses years 1996 through 2002. Data for diagnosis year 2003 will be available by March 2006.

·  What geographic areas (e.g., statewide, particular counties)?

NOTE: Some cases (e.g.,, certain cases identified only through death certificates recorded outside Missouri) may not be available for release.

If requesting an electronic file, what specifications are needed (e.g., computer medium, format type, type of delimiters)?

3)  Describe the study methodology. Also, assurances must be given that the provided data will not be linked with other data sets unless the data linkage is noted below and given approval.

4)  What is the duration of the study? NOTE: If approved, a copy of the study findings must be submitted at the conclusion of the study.

5)  Describe the confidentiality and security measures that will be taken:

7) Who will have access to the records and/or files?

8)  Describe the potential impact of your study (or other use of the data) on the Missouri Cancer Registry and/or the Missouri Department of Health and Senior Services and Senior Services. Describe the possible impact on internal and external stakeholders. Be specific about potential controversy, barriers, political/legislative interest. Describe steps you will take to address these concerns.

9)  Provide assurances that no data will be published, released or re-released in any form that would identify a particular individual. This includes aggregate data with small cell sizes if the identity of an individual could be deduced by the data.

10) Provide assurances that no attempt will be made to contact cancer patients, family members or acquaintances of decedents or infants unless written permission has been obtained from the Missouri Cancer Registry and approval has been granted by the University of Missouri’s Institutional Review Board as well as the Department of Health and Senior Services & Senior Services Institutional Review Board.

11) What disposition will be made of the records/files following completion of the study?

Statement of Confidentiality

If I am granted access to the Missouri Cancer Registry data and the Department of Health and Senior Services and Senior Services (DHSS) information and data for research purposes, I agree to comply with MCR and DHSS confidentiality policies. I agree to maintain the confidentiality of information that identifies individuals. I also agree that I will not subsequently disclose confidential information without written permission of the Department and/or individual person. For research projects requiring access to information covered under the Federal Standard for Privacy of Individually Identifiable Health Information (45 CFR 160 and 164), I agree to comply with the federal requirements.

Principal Investigator’s Printed Name:

Principal Investigator’s Signature:

Date: Date:

Name: Approved by DHHS

Address:

Name:

Signature:

E-mail: Date of Approval:

Telephone: () - Approval Number:

Fax: () -

[Insert Name}

Missouri Department of Health and Senior Services & Senior Services

PO Box 570

Jefferson City, MO 65102-0570

Telephone: (573) ______

Fax: (573) ______

Building NameMissouri Cancer Registry Section VIII Date Revised: 11/2006

1