Map-HD Registry Data Privacy Policy And Procedure
Huntington's Disease Network of Australia (HDNA)
Data Custodian
Monash University
Coordinating Principal Investigator
Prof Julie Stout
1.PURPOSE / BACKGROUND
This document outlines the policy and procedures used to protect the personal information provided by those who create an account within the Map-HD Registry.
The Map-HD Registry data is collected, stored and managed by Monash University, VIC, Australia. As such, the policy and procedures within this document were developed under the guidance of the following:
●Australian Code for the Responsible Conduct of Research (the Code). The Code (2018) is published by the National Health and Medical Research council which is the Australian Government's primary agency responsible for medical and public health research.
●Monash University Research Data Protection and Privacy Collection Statement (2018).
●Monash University Data Protection and Privacy Procedure. This procedure complies with applicable privacy laws in processing personal data, including the Privacy and Data Protection Act 2014 (Vic) (which covers the Information Privacy Principles), the Health Records Act 2001 (Vic) (which covers the Health Information Principles), and to the extent it applies to our activities, the Privacy Act 1988 (Commonwealth) and the General Data Protection Regulation (‘GDPR') (which gives certain rights to individuals who are based in the European Economic Area (EEA) during their interactions with Monash University.
2.DEFINITIONS
Confidentiality Agreement
A written agreement signed by two or more parties which outlines confidential material, knowledge, or information that the parties wish to share with one another for certain purposes but wish to restrict access to.
Data Custodian
Monash University, on behalf of the Map-HD Registry Team, takes ultimate responsibility for the security of the data stored within the registry, as well as responsibility for protecting registry participants from privacy breaches.
Data Custodian's Materials Transfer Agreement
An agreement signed by the Data Requester and Data Custodian which outlines the terms and conditions the Data Requester must agree to with regards to the receipt of data from the Data Custodian.
Data linkage ID
The data linkage ID is a unique number assigned to a Map-HD Registry participant profile that will be used for data linkage when an identifiable ID is required, such as for Enroll-HD.
Data Requester
The individual from a third party seeking access to Map-HD Registry data.
De-identified data
Data that does not include personal information which can be used to identify an individual or the individual's relatives, employers, or household members.
Enroll-HD
A worldwide observational study for HD families, which has four study sites in Australia.
HD
Huntington's Disease
Health information
Information or an opinion provided by or about a participant about their health including illness, injury or disability.
HREC (Human Research Ethics Committee)
An independent committee which reviews all research proposals involving human participants to ensure that they are ethically acceptable.
Identified data
Data which includes personal information about an individual which can be used to identify them, e.g., name, date of birth, gender.
Map-HD Registry Team
The Monash University based team, under the supervision of Professor Julie Stout, is responsible for the daily management of the Map-HD Registry.
Map-HD Steering Committee
The committee that provides oversight of the Map-HD Registry after its launch, and that is responsible for assessing registry data requests, as well as supporting, guiding and overseeing the management of the Map-HD Registry.
Map-ID
A unique participant ID code which is automatically generated based on information entered into the participant's user profile. The Map-ID replaces personal information which can identify an individual when data is shared with a third party.
Personal information
Information or an opinion provided by or about a participant that could identify the participant.
Registry CPI (coordinating principal investigator)
The individual who assumes ultimate responsibility for the management of the Map-HD Registry. They are also responsible for ensuring ethical approval and responding to any ethical matters as instructed by the Human Research Ethics Committee (HREC).
Registry Data Access Team
The team responsible for accessing the data held in the Map-HD Registry. They also liaise with Monash University's information technology (IT) experts regarding the security of the registry database.
Registry Management Team
The team which oversees the tasks performed by the Registry Manager and the Registry Data Access Team. They are also responsible for responding to any concerns or complaints from participants about how their data in the registry is being handled.
Registry Manager
The individual designated by the Registry CPI who takes responsibility for managing the collection, storage, and access of registry data. They also assume responsibility for ensuring the Map-HD Registry data privacy, security and sharing policies and procedures are adhered to in respect to the Map-HD Registry.
Sensitive information
Information or an opinion provided by or about a participant about their genetic status, racial or ethnic origin, political, philosophical and religious views, sexual preferences, criminal record and memberships.
Third parties
Any institution, organisation, business, company, government, industry, or its representative, excluding the Map-HD Registry Team.
3.DATA PRIVACY POLICY
3.1Who is collecting the data?
Monash University ABN 12 377 614 012, acting through its School of Psychological Sciences and the Turner Institute for Brain and Mental Health at Wellington Road, Clayton, Victoria, 3800, and specifically the Map-HD Registry Data Access Team within Monash University, manages the data collected from the Map-HD Registry. The registry data is stored on a secure database supported by Monash University's IT systems in compliance with Monash University's data collection, storage and access policies.
Monash University will handle personal information provided to the Map-HD Registry as set out in this Data Privacy Policy and Procedure document, and otherwise in accordance with the Monash University Data Protection and Privacy Procedure (available at - https://www.monash.edu/__data/assets/pdf_file/0003/790086/Privacy.pdf)
3.2What type of data is collected?
Participation in the Map-HD Registry is voluntary. The mandatory (required) information requested of each participant is:
●First and last name
●Date of birth
●Post code
●Contact details for a preferred mode of contact (via text, email, phone call or post)
●Sex and gender (we need this information to describe the people in our registry, and because inheritance of HD from males to females can be different)
●Whether the participant has had a blood test for the HD gene
●Whether the participant has been diagnosed with HD
The optional information requested includes topics such as:
●CAG-expansion (or repeat number) for those who have had the HD genetic test
●Access to specialist clinicians or services used, if any
●Approximate distance travelled to clinical appointments
●Access to the National Disability Insurance Scheme (NDIS) or Aged Care services
If responses to required fields are not provided, it will not be possible for a user to participate in the Map-HD Registry because their profile will not be saved.
The registration process requires disclosure of personal information which can identify participants, such as name, date of birth and contact details. See section 3.4 'What does the Map-HD Registry do with the data?' for more detail.
3.3How is privacy protected?
Data shared with third parties will be de-identified except in limited specific instances described in this document. Identified data will only be shared for limited purposes. See section 3.4 'What does the Map-HD Registry do with the data?' for more detail.
All publications or reports which use Map-HD Registry data will be reported in aggregate (summary) format only so that participants cannot be identified.
3.4What does the Map-HD Registry do with the data?
De-identified data will be sharable with third parties who have been approved via the Map-HD Registry Data Sharing Policy and Procedures. The process for approval requires an application to the Map-HD Registry Steering Committee for their consideration. The expected use of these data will be for reporting to the government at the state and Commonwealth levels, conducting research, and supporting information requests from pharmaceutical and academic sponsors who wish to use the registry data as part of a Health Technology Assessment aimed at drug pricing or approval for the Pharmaceutical Benefits Scheme (PBS). Parties expected to request the de-identified data include clinicians, researchers, HD State Associations, Government and industry. The Huntington's Disease Network of Australia (HDNA) promotes the sharing of registry data as it enables the key goal of the HDNA to be met, that being to assist in identifying and addressing the unmet needs of those within the Australian HD community.
Identified data such as contact details, birth dates, and other personal information will be retained within the database but access to this data will be limited to registry personnel, who will only have access for the following limited purposes (which require specified, optional consent from participants):
●Accessing contact details so that participants can be reached regarding opportunities which may be of interest or benefit to the participant, e.g., participation in research studies or clinical trials, opportunities to receive new treatments, information about clinical services or support groups in their local area, etc.
●To enable the linking of information of registry participants to other Australian government or clinical databases. Identified information shared will include first name, last name, date of birth, address, sex and a data linkage ID from the Map-HD Registry. For example, the Map-HD Registry team could request data from Medicare about participants' use of medical services, or the PBS about their use of medications, or genetics services about their genetic test results. Data from third party sources could then be used to build a more complete picture of how HD affects peoples' medical needs, use of medical services, etc. The linking of information across databases requires approval by a human research ethics committee. Organisations providing data linkage services are subject to strict conditions regarding treatment of the identified data and will be required to enter into a Data Custodian's Materials Transfer Agreement with Monash University, and may in some instances require an additional informed consent.
3.5Can third parties access the data?
By consenting during the registration process, participants who provide their information to the Map-HD Registry agree and acknowledge that information they provide about themselves may be shared with third parties. Generally, no identified information will be shared except in the limited use case of data linkage. The other relevant exception to this is that participants can opt to have their contact information shared with a chosen HD State Association.
Third parties wishing to access registry data agree to and follow the requirements detailed within the Map-HD Registry Data Sharing Policy and Procedure document. This document details the conditions and limitations of accessing the Map-HD Registry data, and the obligations which must be met and the terms by which they must agree to regarding data handling.
Prior to receiving any data, all recipients of registry data are required to submit written documentation as evidence that a HREC has approved the study for which they are seeking Map-HD Registry data.
3.6Rights of participants
The Map-HD Registry has been approved by Monash Health's HREC (reference #: RES-20-0000-887A; approved 23 March 2021). It is an ethical requirement that all individuals wishing to register their details provide informed consent. This ensures that participants are fully aware of how the information they provide will be used and managed.
Participation is voluntary. Participants can access and update their profile details at any stage. This is done by logging into their profile online and making changes. Participants can also delete information marked as ‘optional', although information marked as ‘required' is unable to be deleted without deleting the entire user profile. Required information entered can be edited/updated however, e.g., if a typing error needs to be corrected, etc.
If a participant wishes to withdraw their consent to participating in the registry, they can simply delete their user profile. For assistance in this process, they can contact info@hdna.com.au.
Participants have the right to lodge a complaint if they have concerns about how any of the information they provide is handled. They can contact either the Monash University Data Protection and Privacy Office at: DataProtectionOfficer@monash.edu, or a member of the Map-HD Registry Management Team, Professor Julie Stout on 03 9905 3987 (julie.stout@monash.edu), or Dr Yifat Glikmann-Johnston on 03 9902 0238 (yifat.glikmann-johnston@monash.edu). All complaints made in writing will be investigated and a response provided.
4.DATA PRIVACY PROCEDURE
4.1How participants' privacy is maintained
Data privacy is maintained in the following ways:
●By de-identification of data prior to sharing with third parties, (4.1.1 below)
●By restricting access to the database which holds the identified data to approved registry staff, (4.1.2 below)
●By sharing identified data for strictly limited purposes, including:
oData linkage (4.1.3 below);
oConnecting participants with an HD State Association of their choice (4.1.4 below)
4.1.1De-identification of data prior to sharing with third parties
When a user profile is created on the Map-HD Registry, a unique participant ID code called a ‘Map-ID' is automatically generated. This code is embedded within the dataset which results from each new registration.
When de-identified data is shared with third parties, only the Map-ID and the variables of interest are provided. Any variables which can identify a participant, e.g., name, address, date of birth, etc., are not exported from the database, and therefore not shared with third parties.
4.1.2Restricting access to the database which holds the identified data
Access to identified registry data is via a secure portal with user ID and password. Access rights are strictly controlled, and limited only to Map-HD Registry personnel who have:
●Completed mandatory training modules at Monash University including ‘Data Protection and Privacy', and ‘Ethics and Professional Conduct';
●Met to discuss and affirm their responsibilities with the Coordinating PI; and,
●Signed the Map-HD Registry Confidentiality Agreement.
4.1.3Sharing of identified data for data linkage
Identified data forms an essential component of the data linkage process, which allows information from existing government and clinical databases to be associated with the registry participants' records. Data linkage is an efficient means of creating a more detailed database that can be used to examine health care utilisation patterns, analyse the economic impact of illness, and to obtain information about clinical and biological measures that have been obtained in other clinical or service settings.
To enable requests from the Map-HD Registry to external databases that may contain additional information on participants, the registry team provides key identifying information about participants, which includes first name, last name, date of birth, address, sex and a data linkage ID. Data linkage requires human research ethics committee approval, agreements between the Data Custodian and the institution with whom the data linkage is taking place. Typically, data linkage requires that identifying information is provided to ‘Data Linkage Units' or DLUs, which serve as intermediaries who use identifying data to match specific cases between two data bases. To protect confidentiality of the data, DLUs are subject to conditions detailed in data use agreements entered with the Data Custodian.
4.1.4Sharing of identified data for connecting participants to an HD State Association of their choice
The Map-HD Registry is aimed at the HDNA's mission, to foster the best quality of life for every person in Australia affected by HD. In recognition that all States and Territories have Associations which are charged with supporting HD communities and families, and in recognition of the collaboration between the HDNA and the HD State Associations, the Map-HD Registry includes a specific opt in for participants that allows the registry staff to provide the contact details of participants to an HD State Association of their choice. Those participants who opt in to sharing their contact details affirm their willingness for the Map-HD Registry staff to provide their contact details to their chosen HD State Association. Contact details shared include first name, surname, and the selected preferred mode of contact of the participant (either residential address, email address, or phone number). No other personal, health or sensitive information will be shared with the HD State Association.