Form #1 HCUP Data Use Agreement Training

Healthcare Cost and Utilization Project Data Use Agreement Course

Whatever ... I see or hear... which ought not to be spoken of abroad, I will not divulge, as reckoning that all such should be kept secret. ~Hippocratic Oath, circa 4th Century B.C.

When all is said and done, will our health care records be used to heal us or reveal us? ~Donna Shalala, Former U.S. Secretary of Health and Human Services

Protecting the privacy of the individuals and institutions that are featured in your health care research is imperative. The HCUP Data Use Agreement safeguards the confidentiality of patients, physicians, and health care institutions.

Menu

skip nav 1. Introduction 2. HCUP and AHRQ 3. Why Adherence Is Important 4. Protection of Individual Identities 5. Restrictions on Hospital ID 6. Appropriate Use of Data 7. Data Use Restrictions 8. HIPAA 9. Publishing Recommendations 10. Review 11. Conclusion

1. Introduction

Welcome to the Healthcare Cost and Utilization Project (HCUP) Data Use Agreement (DUA) Training!

HCUP databases offer a national information resource of discharge-level health care data. Because of the sensitive nature of health data, this information must be safeguarded to protect the privacy of individuals and institutions. The purpose of this course is to:

• Emphasize the importance of data protection

• Reduce the risk of inadvertent violations

• Describe your individual responsibility when using HCUP data

This course will take approximately 15 minutes to complete. After completing the training you will gain access to the HCUP Data Use Agreement. The goal of this course is to explain important requirements in the HCUP Data Use Agreement.

HCUP Data Use

When working with health care information, researchers have a responsibility to maintain the privacy rights of the individuals and institutions featured in their data. The proper use of HCUP databases, including strict adherence to the Data Use Agreement, will help protect the availability of this valuable data resource.

• HCUP data contain confidential information concerning the clinical condition of patients and the medical services they receive. The HCUP Data Use Agreement contains specific requirements to protect the privacy rights of the individuals and institutions within the HCUP data sets.

• HCUP databases provide a wealth of information to enhance your health care research and promote the advancement of the field. You are responsible for safeguarding the HCUP data that you obtain. Guarding the confidentiality of the data and the privacy of individuals is vital to the continued availability of health data to researchers in the future.

The goal of this course is to explain important requirements in the HCUP Data Use Agreement.

To return to the Menu, select this link: Return to Menu

2. HCUP and AHRQ

The Agency for Healthcare Research and Quality (AHRQ) is a Federal agency within the Department of Health and Human Services. AHRQ's mission is: "To improve the quality, safety, efficiency, and effectiveness of health care for all Americans." To accomplish this goal, AHRQ supports a broad base of health care research. AHRQ also sponsors the Healthcare Cost and Utilization Project (HCUP).

• HCUP databases bring together the data collection efforts of state-level Data Organizations (HCUP Partners) and the Federal government.

• HCUP uses the state-level data to create a uniformly formatted national information resource of discharge-level health care data.

• Health care researchers gain online access to information about HCUP databases at www.hcup-us.ahrq.gov. (Clicking this link will open a new window.)

• Health care researchers publish their findings to promote improvements in many aspects of health care, including quality, cost, delivery, and disparities in health care services.

HCUP data are a valuable resource for the health care research community. It is vital to maintain a balance between protecting data privacy and securing the use of data in national health care research. Strict adherence to the HCUP Data Use Agreement (DUA) ensures the long-term viability of HCUP. Violations of the DUA could force AHRQ to discontinue providing public release versions of the data.

To return to the Menu, select this link: Return to Menu

3. Why Adherence Is Important

You must sign a Data Use Agreement (DUA) before you are given access to HCUP data. The DUA is a legally binding agreement with AHRQ that defines how you can use HCUP data. The DUA covers the following topics:

Individual responsibility

Your signature on the DUA acknowledges that:

1. You have read and understand the requirements for using HCUP data.

2. You agree to be bound by AHRQ rules and regulations in the DUA.

3. You understand that there are civil and criminal penalties for violating any provision of the DUA.

You will be held personally responsible for adherence to each clause in the agreement. Remember, you are responsible, not your organization.

State regulations

Each participating Data Organization that contributes data for HCUP databases has its own policies and state regulations on data use and handling. The provisions outlined in the DUA reflect the requirements contained in legal Memorandums of Agreement (MOA) between each contributing state Partner and AHRQ. You are responsible for complying with these state-specific requirements.

Consequences

When you sign the DUA, you agree to comply with the requirements listed. If you violate the DUA, the following consequences may occur.

• Legal consequences: You may be fined and/or sentenced to a prison term.

• Restricted use of data: If a violation were to occur, it could have long-term effects on the credibility of other health care researchers. This misuse could result in a loss of cooperation from other agencies and lead to restricted access to data.

To return to the Menu, select this link: Return to Menu

4. Protection of Individual Identities

HCUP data contain discharge-level information on inpatient, ambulatory surgery, or emergency department care in U.S. hospitals. For confidentiality purposes, all data elements that directly identify an individual have been removed.

However, through deliberate and sophisticated technical analysis, it might be possible to ascertain the identity of particular persons. This would be considered a violation of the HCUP DUA. Any attempts to identify individuals are prohibited, and information that could identify individuals directly or by inference must not be released or published.

• Do not attempt to learn the identity of individuals and prohibit others from doing so.
  
  HCUP data exclude information that could directly identify individuals, such as names, Social Security Numbers, and addresses of patients and physicians. The DUA prohibits users from making any effort to discover the identity of any person in the data.
  
  This restriction includes patients, physicians, and other health care providers. It is also your responsibility to prohibit anyone else who has access to HCUP data from identifying individuals within the data.

• Do not report tabulated data in a cell size less than or equal to 10.
  
  In a small sample, an identity could be determined indirectly (e.g., a single case of AIDS in a small town). Such a disclosure would be a direct violation of the privacy rights of that individual.
  
  Do not report tabulated data in a cell size less than or equal to 10.

Protection of Individual Identities DUA Excerpt 1

"I will not attempt to use and will prohibit others from using the data set to learn the identity of any person included in the data set or to contact any such person for any purpose."

Protection of Individual Identities DUA Excerpt 2

"I will not release or disclose information where the number of observations (i.e., individual discharge records) in any given cell of tabulated data is less than or equal to 10."

Scenario 1:

Sara:

"Hi Donna. How is your research report coming along?"

Donna:

"Great. I am using HCUP data to study a rare medical condition, Kawasaki's disease in children. In certain counties or geographical areas, the incidence of the condition reveals only one or two cases of the disease in a given year. I would like to publish these findings and include a table recording the incidence of the disease for these areas. However, within the table there will be 'cell sizes' under 10. Can I get an exception for this restriction and publish it with these smaller cells?"

Narrator:

"Can Donna publish her findings of the incidence of Kawasaki's disease?"

Choose the best answer.

• a. Yes, since this is a rare disorder, Donna can publish her findings.

• b. Yes, if she receives approval from Sara, her supervisor.

• c. No, this would be in violation of the HCUP DUA.

Select this link for the answer to Scenario 1: Scenario 1 Answer

To return to the Menu, select this link: Return to Menu

5. Restrictions on Hospital Identification

Depending on the policies and laws of the state providing the information, HCUP data may include the identities of hospitals and other health institutions. The identities of these institutions are made available for research purposes, but must not be disclosed through publication or any other means.

Restrictions on Hospital Identification DUA Excerpt

"I will not use and will prohibit others from using the data set concerning individual establishments to report, through any medium, data that could identify, directly or by inference, individual establishments."

To return to the Menu, select this link: Return to Menu

6. Appropriate Use of Data

As someone who works with confidential information, it is important for you to know what you can and cannot do with it. You are responsible for how you and others in your research group use the HCUP data to which you have access.

• You may use HCUP data for research, analysis, and aggregate statistical reporting.

• You may share HCUP data with your immediate research group. HCUP databases are created by and for researchers. Sharing information is critical to research projects, but you must not share HCUP data outside of your immediate research group. Please note that each member of the group must take this training. In addition, each must sign the HCUP Data Use Agreement and send it to the address at the bottom of the form.

• You may merge other data with HCUP data to conduct research when state organizations have provided data elements that allow this (e.g., hospital identifiers, counties, ZIP Codes). Linking to outside data sources is permissible when the linkage is used to enhance the data and not to identify individuals. You may also share summarized data for inclusion in publications. Raw micro data may not be shared outside your immediate research group.

Appropriate Use of Data DUA Excerpt 1

"I will not use nor permit others to use the data in these sets in any way except for research, analysis, and aggregate statistical reporting."

Appropriate Use of Data DUA Excerpt 2

"I will not release or disclose, and will prohibit others from releasing or disclosing, the data set (or any part) to any person who is not a member, agent, or contractor of the organization, except with the approval of AHRQ."

Appropriate Use of Data DUA Excerpt 3

"I will not attempt to link, and will prohibit others from attempting to link, the discharge records of persons in the data set with individually identifiable records from any other source."

Scenario 2:

Narrator:

"John is a new research contractor with Health Research Services, Inc. How can John and his colleague abide by the terms of the HCUP DUA?"

John:

"I'd like to do a hospital-level comparison according to the economic profile of the county in which the hospital resides. I want to include in my report hospital-level charges, volumes, and outcomes for patients with certain conditions. How can I use the HCUP data within my research report?"

Tom:

"Some of the state-level HCUP data include hospital identification, counties, and ZIP Codes. Perhaps you could link county records concerning demographics with the information contained in HCUP data to create a hospital-level analysis."

Narrator:

"Under what conditions can John use the HCUP data? (Choose all that apply)."

• a. If he signs a Data Use Agreement

• b. If John doesn't disclose hospital identification

• c. If he uses his research for marketing purposes

Select this link for the answer to Scenario 2: Scenario 2 Answer

To return to the Menu, select this link: Return to Menu

7. Data Use Restrictions

Use of confidential data can be a complicated process. We want to help you avoid inadvertent violations of the HCUP Data Use Agreement. Certain restrictions on the use of HCUP data exist to prevent the violation of individual and institutional privacy rights.

• Do not use the data for commercial or competitive purposes (e.g., competitive marketing or competitive contracting), or to determine the rights, benefits, or privileges of individual establishments. For example, activities such as analyzing the volumes or prices of an individual hospital for contracting purposes is prohibited. In addition, using the HCUP data to determine whether your hospital can compete for a certain line of business, given the volume or pricing of a competing hospital in the local market, is prohibited.

• Do not contact any institution to verify the data within the HCUP data sets.

Data Use Restrictions DUA Excerpt 1

"In accordance with the AHRQ confidentiality statute, I will not use and will prohibit others from using the data set concerning individual establishments (1) for commercial or competitive purposes involving those individual establishments; (2) to determine the rights, benefits, or privileges of individual establishments."

Data Use Restrictions DUA Excerpt 2

"I will not contact and will prohibit others from contacting establishments or persons in the data set to question, verify, or discuss data in the HCUP databases."

Scenario 3:

Lisa:

"Lakeview Hospital. This is Lisa speaking."

Stephen:

"Hi Lisa, my name is Stephen Gossling. I am a health care researcher with Burnside University. I am using HCUP data to research the prevalence of newborn respiratory illnesses within the western United States. I have some questions about your data on newborn respiratory illness and would like to verify the number of cases that were admitted to your hospital three years ago."

Narrator:

"Which of the following is a violation of the HCUP DUA? (Choose all that apply)."

• a. Contacting an institution to question, verify, or discuss HCUP data

• b. Identifying individuals within HCUP data

• c. Linking HCUP data to the Health Resources and Services Administration's Area Resource File

• d. Comparing (benchmarking) results from the HCUP data to another data source

Select this link for the answer to Scenario 3: Scenario 3 Answer

To return to the Menu, select this link: Return to Menu

8. HIPAA

The HIPAA Privacy Rule sets national standards for patient rights with respect to health information. This rule protects individually identifiable health information by establishing conditions for its use and disclosure by covered entities.

AHRQ and the Definition of Covered Entities

AHRQ and most Data Organizations participating in HCUP are not covered entities because they do not fit the definition of a:

• Health plan

• Health care clearinghouse

• Health care provider that electronically transmits health information

However, a few HCUP Data Organizations have business associate agreements with covered entities that require them to comply with HIPAA requirements.

HCUP Data are Limited Data Sets

HCUP databases conform to the definition of a limited data set. A limited data set is health care data in which 16 direct identifiers, specified in the Privacy Rule, have been removed.

HCUP is consistent with HIPAA regulations

The HCUP DUA is consistent with HIPAA requirements for use of a limited data set.

Further information on the HIPAA Privacy Rule can be found at: http://www.hhs.gov/ocr/hipaa or http://privacyruleandresearch.nih.gov/. (Clicking on these links will open a new window.)

To return to the Menu, select this link: Return to Menu

9. Publishing Recommendations

AHRQ and its state Partners must demonstrate that HCUP data are used to generate significant research contributions that satisfy the mission of the Agency. Therefore, it is crucial to properly cite and acknowledge AHRQ and the specific HCUP databases used in your publication.

Suggested citations for HCUP databases and tools can be found on the HCUP-US Website.

http://www.hcup-us.ahrq.gov/tech_assist/citations.jsp (Clicking on this link will open a new window.)

Publishing Recommendations DUA Excerpt

"I will acknowledge in all reports based on these data that the source of the data is the 'Nationwide Inpatient Sample (NIS), Healthcare Cost and Utilization Project (HCUP), Agency for Healthcare Research and Quality."

To return to the Menu, select this link: Return to Menu

10. Review

During this course, you have learned the importance of adhering to the regulations outlined in the Data Use Agreement.

Let's review how the HCUP DUA benefits patients and health care providers, AHRQ, HCUP data partners, and you.

HCUP and AHRQ

HCUP is a family of health care databases and related software tools and products developed through a Federal-State-Industry partnership and sponsored by the Agency for Healthcare Research and Quality. HCUP data contain confidential information describing the clinical condition of individuals and the medical care received. It is essential to provide safeguards for such data in order to protect the privacy of individuals. This emphasis on protection also helps to ensure that HCUP data remain available for future health care research.

Importance of Adherence

It is important for you to understand the confidential nature of HCUP data and what you can and cannot do with it. Everyone given access to the HCUP data must sign a DUA which outlines how the data may be used. Civil or criminal penalties will be enforced for anyone who violates the requirements of the HCUP DUA.

Protection of Individual Identity

The information in the HCUP database is anonymous. Do not attempt to learn the identity of individuals within the HCUP data sets, including patients and providers. Do not release or disclose any data where the number of observations in any given cell of tabulated data is less than or equal to 10.

Restrictions on Hospital Identification

Hospital identification is available in many state-level databases for research purposes. Do not publish or disclose the identity of these institutions.

Appropriate Use of Data

You are responsible for how you and others use the data to which you have access. You may:

• Use the data for research, analysis, and aggregate statistical reporting.

• Share the data with your immediate research group, if all members have signed and agree to adhere to the statutes of the DUA.

• Merge outside data to HCUP data to conduct health care research as long as you do not attempt to identify individuals within HCUP data sets.

Use Restrictions

You are prohibited by the HCUP DUA from:

• Using the data for commercial or competitive purposes.

• Using the data to determine the rights, benefits, or privileges of individual establishments.

• Contacting an institution to question, verify, or discuss the data.

HIPAA

While AHRQ is not a covered entity, the HCUP DUA is consistent with HIPAA requirements for use of a limited data set.

Publishing Recommendations

It is important that you properly acknowledge AHRQ and the specific databases used in your publication.

To return to the Menu, select this link: Return to Menu

11. Conclusion

Congratulations! You have completed the HCUP Data Use Agreement course.

This course has discussed the key elements of the Data Use Agreements, but does not include every requirement. Please read the DUA thoroughly before signing it. The HCUP DUAs can be accessed on the HCUP-US Website. (Clicking on this link will open a new window.)

You only need to take this course once. If you obtain more HCUP data in the future, you will be asked to sign another DUA, but you will not need to complete this course again. When you send in future applications for data you can either include copy of the course or the course certificate code on the application form.

To verify you have completed the course, print the course certificate that will include your name and the certification code. It is highly recommended you print this certificate and keep it for your reference.

Your certification code is:
HCUP- 6IXX58M72

Input your full name here, then select the link to print your certificate: Print Certificate

If you are having difficulty with this course, please contact HCUP Technical Assistance staff at [email protected] for assistance or call (toll-free) 1-866-290-HCUP (4287).

To return to the Menu, select this link: Return to Menu

Answers:

4. Protection of Individual Identities: Scenario 1

Question 1 = c. No, this would be in violation of the HCUP DUA.

The HCUP DUA stipulates that all published results must be reported with cell sizes greater than 10. One or two cases of a rare medical condition in a given geographic area are too few to report while preserving confidentiality. Cell sizes fewer than or equal to 10 could inadvertently reveal identity. These cases will need to be reported by combining the geographic areas up to a cell size greater than 10.

To return to Section 4, select this link: Return to Section 4

To return to the Menu, select this link: Return to Menu

Answers:

6. Appropriate Use of Data: Scenario 2

Question 1 = a. If he signs a Data Use Agreement and
                    b. If John doesn't disclose hospital identification.

Hospital-level analysis can be done, but the identification of hospitals must be protected. John can enhance his data with links to other data, but he must stay within the limits of the HCUP DUA. Also, as a member of the research group, John must sign the DUA. Use of HCUP data for marketing purposes, such as using the information in the HCUP data for commercial or competitive purposes involving individual hospitals, is a violation of the DUA.

To return to Section 6, select this link: Return to Section 6

To return to the Menu, select this link: Return to Menu

Answers:

7. Data Use Restrictions: Scenario 3

Question 1 = a. Contacting an institution to question, verify, or discuss HCUP data
                    b. Identifying individuals within HCUP data

Stephen's actions are in violation of the HCUP DUA. Stephen cannot contact an institution to question, verify, or discuss HCUP data, or to identify individuals within the data. However, Stephen can link HCUP data to additional data sources, such as the Health Resources and Services Administration's Area Resource File. Stephen may also benchmark his results from HCUP data to another data source.

To return to the Section 7, select this link: Return to Section 7

To return to the Menu, select this link: Return to Menu

Resources

Helpful Links:

Clicking on these links will open a new window.

HCUP User Support Website (HCUP-US)     Everything about HCUP data, tools, and products

Suggested Citations for HCUP     Please properly cite and acknowledge HCUP

Department of Health and Human Services/HIPAA Site     The Office of Civil Rights

Privacy Rule and Research/HIPPA Site     The National Institutes of Health

HCUP Data Use Agreement Training Interactive Version     Interactive version of this training tool

To return to the Menu, select this link: Return to Menu

This course may not be copied, photocopied, reproduced, translated, transmitted,
or electronically converted in whole or in part without the prior written consent of
the Agency for Healthcare Research and Quality (AHRQ).

Created by Allen Communication Learning Services
for the Agency for Healthcare Research and Quality (AHRQ)

(866) 310-7800