The harmonized EHR data that do require an approved DUR to access are made available in two different “levels” (known as Level 2 and Level 3 for historical reasons–see below), each with different amounts of data obfuscation, and correspondingly different access requirements. Deciding which level of data is appropriate for your study is important, because accessing Level 3 data is more work and restrictive than accessing Level 2 data. On the other hand, some studies can be accomplished with only Level 3 data. Note that if you start with a lower level of data, it is possible to “upgrade” a project’s access level, though all participants in the project will need to complete another DUR for the new level.
In addition to the primary Level 2 and 3 datasets are “PPRL” data. PPRL data includes extra non-EHR sources of information such as obituary-based mortality records and viral variant sequencing information. These are available alongside only Level 3 data as an optional add-on; we’ll discuss PPRL in more detail below.
+In order to preserve the ethical use of unconsented data for public health benefit, every attempt to obscure identities of institutions, communities, or individuals contributing data should be taken as shown here. Access to EHR-derived data should minimize privacy and never provide more access to identifiers than is required for the research question.
+Level 3, or LDS data is the most complete and protected (the term “limited data set” is defined by HIPAA and may contain a limited set of potentially identifying information). This dataset contains two pieces of Protected Health Information (PHI) defined by HIPAA: full, 5-digit patient zip codes,1 and accurate dates of events and services (except for dates of birth which are limited to month and year).2 Level 3 data are in the OMOP common data model, with some N3C-specific additions and conveniences, and are versioned as releases as described above. (OMOP and N3C-specific additions are covered in Chapter 7.)
@@ -568,6 +581,19 @@RP-XXXXXX prefix.
Work in one project workspace can access only data or files from another project workspace if a “reference” has been added from the former to the latter. Researchers do not have permission to add such references. Thus, access from a research project workspace to protected datasets is possible only if the appropriate references have been added by administrators, which is done after a corresponding Data Use Request has been approved. Said another way, rather than providing researchers access to data, researchers are provided access to project workspaces, and these are in turn provided access to data.
This reference-based permission scheme supports a number of useful features for N3C. Naturally, restricting workspace access to a subset of data affords the possibility of different levels of data access with correspondingly different access requirements. A single researcher may be involved with multiple research projects of different levels but cannot share data or files across them, thus it is impossible for a researcher with access to Level 3 data to share it with their colleagues in another project with Level 2 data.
+Shared workspaces facilitating secure, collaborative data access are not unique to N3C amongst cloud-hosted, centralized RWD environments. These technologies, coupled with appropriate governance and team-science principles, can facilitate successful research projects in the face of data complexity.
+