Prerequisites for Access to Clinical Data for Research

WCM faculty, staff, and students routinely need to access sensitive data as part of their job duties. While ITS policydetails how this information should be handled, there are a number of requirements specific to the conduct of clinical research. Below follows a brief checklist of requisite items that must be fulfilled before WCM personnel can access sensitive patient data. Please note that depending on the data set, additional requirements may apply.

• Weill Research Gateway access
• HIPAA training (to be completed within the Learning Management System)
• CITI Good Clinical Practice and Biomedical Research training (to be completed at http://www.citiprogram.com)
• Attestation of conflicts of interest (to be completed within the Weill Research Gateway)
• IRB approval (note that this can either constitute a formal protocol or IRB determination of exempt status, but investigators cannot self-certify that their research does not require IRB review)
• High-Risk Data Attestation
• Data Core user agreement, if applicable

Additionally, WCM personnel can sponsor access for non-WCM personnel to access WCM resources to conduct study activities, such as data analysis in the Data Core and/or submission of IRB protocols in Weill Research Gateway. Access may involve some or all of the following steps.

• CWID creation via request by a department’s Chief Administrator Officer
• Federated identity registration with Cornell University (NetID), Hospital for Special Surgery, Memorial Sloan Kettering Cancer Center, and/or other institutions

For studies with CUIMC involving data sharing, one or more of the following may apply.

• Data use agreement (DUAs) execution, especially with CUIMC, for receiving CUIMC data. CUIMC Sponsored Projects Administration and WCM Office of Sponsored Research Administration and/or Joint Clinical Trials Office generally execute DUAs necessary for CUIMC-WCM data sharing. WCM requests for agreements occur through Weill Research Gateway’s Sponsored Programs module.
• IRB protocol approval from WCM and CUIMC. The protocols should describe the same study and the collaboration between institutions, including names of investigators.
• TRAC approval for automated EHR data extraction. Separate TRAC requests submitted by WCM and CUIMC collaborators describing the combined study and data sharing intent enable data acquisition and sharing. The TRAC requests should also include the approved IRB protocol from the institution and a copy of the executed DUA.

For studies involving collaboration with NYP Queens, NYP Brooklyn Methodist, and CUIMC, the following may apply.

• IRB approval at WCM
• Study-specific WCM IRB reliance with IRBs at NYP Queens, NYP Brooklyn Methodist, Columbia University Irving Medical Center (CUIMC).
• TRAC approval with accompanying documentation from WCM and CUIMC IRBs
• A DUA if sharing data with CUIMC

Of note, the CUIMC IRB covers NYP/CUIMC, NYP/Allen, NYP/Hudson Valley, NYP/Lawrence, and NYP/Morgan Stanley Children’s.

To conduct a study across all NYP campuses, approval is necessary from the IRBs at WCM, CUIMC, NYP Queens, and NYP Brooklyn.