FAQ for File Sharing with Monitors

March 2022

File sharing with Outside Monitors

1) The study monitor is asking to see case report forms (CRF) and other study documents that contain PHI/PII. Is there a preferred tool to share these documents and do they need to be redacted?

In cases where source documentation from the electronic medical record needs to be shared for source document verification, the site should utilize CareLink to grant external study monitors read-only access to a list of participants pre-populated by the Johns Hopkins study team for monitoring. Please see the following CareLink URL for more information: https://www.hopkinsmedicine.org/CareLink/research-study-monitoring.html

Other study information (e.g., study data, informed consent forms, etc.) should be shared via JHOneDrive. JHOneDrive is secure and HIPAA compliant and may be used to allow monitors that are internal or external to the covered entity to access study documents with PHI/PII.

Study teams must ensure the plan for sharing data and study materials aligns with the IRB approved protocol, consent form, and all applicable agreements/contracts. If the protocol, consent and any applicable agreements indicate a limited dataset will be shared, or that only de-identified data will be shared, then identifiers must be removed prior to sharing.

2) Is there a time limit for sharing documents in JHOneDrive with outside monitors?

JHOneDrive is approved for short-term storage and access to HIPAA protected data. It should not be used for long-term storage. It is best practice to keep the permissions open to only those that need them for current monitoring purposes and then revoke them following the completion of that work. Additionally, users outside of the covered entity should be given view only access in JHOneDrive.

3) Should MS Teams be used to share documents with outside monitors?

No. JHOneDrive is the preferred method for sharing files outside of the institution. MS Teams is easier to use for collaboration with internal users. It is the study team’s decision if JHOneDrive, Share drives, or MS Teams are preferred for internal collaboration among the JHU study team.

4) Our sponsor monitor wants access to Epic. Is there an approved method for granting them access?

Yes. Sponsor and monitors outside JHU may utilize CareLink, a Web-based portal that permits real-time access to research participants’ electronic medical records (EMR), lab results and imaging reports. Study monitors are granted view-only access to a list of patients pre-populated in CareLink by the Johns Hopkins study team for monitoring. Study monitors will not have any capability to lookup other patients in the EMR besides those on the list. Use of the CareLink system is monitored by the study team.

Please see the following link for more information about CareLink and refer to the start-up guides: https://www.hopkinsmedicine.org/CareLink/research-study-monitoring.html

5) If I have other questions or need additional information about Data Sharing, where can I go to find out more?

You can find more information from the following links:

Data Trust Council, Research Data Subcommittee: https://intranet.insidehopkinsmedicine.org/data_trust/data-trust-organization/research-data-subcouncil.html

IT Risk: https://it.johnshopkins.edu/it-services/ or [email protected]

File Sharing with JHM OHSR Compliance Monitoring Program Monitors

1) The JHM Compliance Monitoring Program (CMP) has contacted me to perform remote monitoring. The CMP wants study data and other materials sent to them. What is the secure way to send this information?

The CMP will request that you send the necessary study materials via JHOneDrive. OneDrive is JHU authorized as a file and data sharing platform that is secure and HIPAA compliant. There is no need to redact information sent via JHOneDrive.

2) Does the CMP need to be given access to CareLink?

No. All CMP monitors have access to Epic which allows for source data verification.