1. UCSF Mission

2. Health Data Governance established six high-level principles that should govern all access to and use of UC Health Data:

a. Responsibility and Mission - UC must have a strategy that safeguards data, uses data to broadly benefit the public, and ensures just distribution of benefits and burdens of data sharing.

b. Justice - ensuring benefit to the public considers societal and healthcare inequalities.

c. Active Stewardship - rigor in assessing benefits with responsibility and rigorous science

d. Public trust and patient engagement

e. Sharing Data Outside UC for Public Benefit - The University must articulate a clear public benefit in any arrangement in which clinical data is shared outside of the University, especially for commercial transactions. Financial gain and commercial development, by themselves, are not a clear public benefit.

f. Alignment & Collaboration - no arrangement should unreasonably exclude other arrangements, or prevent UC's use of data to advance its mission.

3. All Health Data transactions must have a clearly articulated benefit that is consistent with the UC mission and the six principles above.
 

When the UC Data Sharing Considerations above are met, the following criteria must also be met prior to sharing of data with a third-party:

1. Sharing of or access to P3 and P4 data with third-parties must meet UC contracting guidelines and include this key criteria:

a. Sharing of data must be non-exclusive.

b. If the other party will be able to view Health Data, it must be de-identified according to HIPAA privacy regulations.

c. The third party must be prohibited from re-identifying the data (e.g., combining it with consumer data)

d. The third party may not further disclose the data (including to an affiliate, unless specifically agreed)

e. The third party may only use the data for the discrete purposes specified in the agreement; that use must serve a clearly articulated public benefit; and the third party must return or certify destruction of the data after such use.

f. As applicable, UC should receive an appropriate license to the “transformed”/structured data.

g. [shall we identify minimum indemnity and insurance requirements, with exceptions allowed for domestic academic collaborators? This is baked in to procurements, not for campus collaborative projects.]

2. Bring the code to the data - to the extent feasible, projects using UC Health Data are encouraged to be conducted within UC’s HIPAA-secure environments, rather than through external transfers of large data sets outside UC.

3. EIA review and assessment is required for all requests to access UCSF P3 or P4 data identified as high risk. For single-campus projects, the EIA committee will make a recommendation about whether an on what terms to proceed, with final decision residing with the Chancellor. High risk requests include:

a. Single-campus projects that do not meet UC contracting guidelines [since UCSF expanded this from health data, we may need to refine this to avoid an avalanche of reviews].

b. Single-campus projects that include sharing de-identified Health Data or any P3/P4 data with high risk countries [or simplify to all international sharing?]

c. The EIA will subsequently submit for UC Tiger Team review high-risk projects that meet the following criteria:

i. Multi-campus projects involving UC Health Data.

ii. Projects that share patient identifiable data. [clarify this, we've see that MC Procurement has need to share PHI routinely - seek campus EIA delegation for TPO?]

iii. Projects that have potential for heightened public concern, harm trustworthiness, or confusion among patients or the public.

These terms must be included in any contract with a third party involving the use by that third party of health data acquired and maintained by UCSF, whether or not UCSF faculty or staff are participating in the contractual arrangement. A third party is defined as any for-profit or not-for-profit entity not owned or controlled by The Regents of The University of California.

Health data is defined as any information pertaining to the health, care, and treatment of UCSF Health patients or health plan members which: (1) results in a report used in treatment or monitoring of a patient; (2) generates a claim or a bill for services is provided; and/or (3) is used for operations, financial management, population health activities or quality metrics. These data will be considered source health data. Derived health data is any derivation of source health data irrespective of how trivial or complex the derivation may be. Prospectively-collected clinical research data and related research results will not be considered health data as long as these data are collected/created exclusively for a sponsored research study with an IRB approval and the data are collected pursuant to patient authorization and consent. Any other health data associated with subjects participating in clinical trials will be considered health data as defined above. Non-health data is all other data collected at UCSF Health.

UCSF Health anticipates that, as a condition for third party use of its sensitive data, that the use result in a tangible outcome that directly or indirectly benefits UCSF’s mission, patients and society, in general.

The interested third party must be agreeable to the following terms:

Data Use

1. Exclusivity: the third party will have no rights to the use of the dataset that will prohibit or otherwise limit the use by the University of California (UC) for any research, patient care or educational purpose for any time period.
2. Protected Health Information: only de-identified health data (per UCSF Health standards)1 may be considered for sharing.
3. High-risk Datasets: datasets focused on, but not limited to, HIV, hepatitis, psychiatric illness, drugs of abuse laboratory testing, sexual orientation and gender identity, and genetic tests must be reviewed by the Chancellor’s Executive Team and the University of California Office of the President (UCOP).
4. Multi-campus Datasets: requests for datasets from more than one UC health campus must be reviewed the Chancellor’s Executive Team and by UCOP.
5. Data Management: the dataset should not be aggregated into a larger dataset owned by the third party, and the dataset must reside in a secure, agreed upon location. The third party must maintain strict access logs, provide UCSF Health the ability to audit these logs, and purge the dataset (and all associated backups) at the conclusion of the project.
6. Subsequent Data Use: datasets cannot be resold, transferred, or reused for any other purpose other than what is outlined in the final agreement with the third party.
7. Publications: (when UCSF faculty are involved) derived from the use of the datasets must include UCSF authors and contribute in a meaningful way to improving the health of our patients and society.

Cost Recovery

1. Faculty and/or Staff Direct Costs: (when UCSF faculty are involved) direct costs related to faculty and/or staff time (percent of their FTE) spent on the project must be covered by the third party. 
2. Faculty and/or Staff Indirect Costs: (when UCSF faculty are involved) indirect costs related to faculty and/or staff time set as a percent (__%) of the total direct costs must be covered by the third party.
3. Data Preparation and Processing Costs: costs related to identifying and preparing the dataset must be covered by the third party. This cost shall be separate and distinct from the consideration secured by the licensing fee negotiated by UCSF IT Governance Enterprise Information and Analytics (EIA) Committee.

Liability

1. Indemnification/Insurance: the third party must agree to UCSF standard indemnification language and insurance requirements.
2. License and Data Use Agreement: the third party must agree to sign an appropriate license negotiated and executed by UCSF ITA or Industry Contracts groups incorporating UCSF’s mandatory data use terms and conditions. Violations by the third party would be subjected to penalties.

If required, institutional review board (IRB), export control, and conflict of interest (COI) reviews must be completed prior to the execution of any third party term sheet.

Enter content.

Enter content.