· Web viewAcronyms3. Definitions4. Background5. Retinoblastoma5. eCCRB5. Program Information7....

00`

eCancerCareRetinoblastoma Database Governance

Phase 0

May 3, 2016

Table of ContentsAcronyms....................................................................................................................................3Definitions...................................................................................................................................4Background.................................................................................................................................5

Retinoblastoma.......................................................................................................................5eCCRB......................................................................................................................................5

Program Information...................................................................................................................7Overview................................................................................................................................. 7Objectives............................................................................................................................... 7Management...........................................................................................................................7

Program Roles & Responsibilities...............................................................................................8Participants..............................................................................................................................8Roles and Responsibilities of eCCRB Consortium Committees................................................9Roles and Responsibilities of Personnel...............................................................................12

Quality Management.................................................................................................................18Minimum Input Required.......................................................................................................18Data Entry Quality Control.....................................................................................................18Data Access..........................................................................................................................18

Publications...............................................................................................................................21Authorship.............................................................................................................................21

Privacy and Confidentiality........................................................................................................22Written Informed Consent.....................................................................................................22

Financial Management..............................................................................................................23Data Entry............................................................................................................................. 23Fundraising............................................................................................................................23

Sponsors Management.............................................................................................................24Data Field Changes..................................................................................................................25Risk & Security Management....................................................................................................26Performance Management.......................................................................................................27References............................................................................................................................... 28Appendices...............................................................................................................................29

Appendix I: eCCRB Consortium Governance Diagram...........................................................29Appendix II: Role Based eCCRB Access Matrix.....................................................................30

Suggested additional sections [to be validated depending on the project’s needs]:

Storage of datao Include a section detailing storage conditions (ex: dedicated server, location,

security measures). o Include information on how long data will be kept for (different duration time-

frames may apply for research vs. clinical use). Patient recruitment

o This is information is currently found across different sections of the document. It might be clearer to regroup all relevant information under a single heading.

o Include information, for example, on: how will patient be approached and enrolled, inclusion criteria (if any), exclusion criteria (if any), core elements of consent, etc.

eCCRB Database Governance, Phase 0 Page 2 of 31May 3, 2016

Emily Kirby, 2016-07-21,

Just as a note – we usually use “participant” in the context of research, but since eCCRB has a strong clinical-use component, “patient” may be more appropriate and has been used throughout the text.

Patient re-contact for future studies [Do you anticipate the possibility of re-contacting certain patients, if researchers accessing the database would like to conduct separate studies? Or is participation limited to eCCRB exclusively?]

o Information on modalities of re-contact (what studies would be eligible for re-contact? How would patients be selected and approached? Consent elements to include, etc.).

Patient withdrawalo Include information on how patients can withdraw (modalities), and how

withdrawal will be managed (destruction of data vs. anonymization, etc.). Different modalities might also apply to the platform for clinical use vs. platform for research use (i.e. there could be an option to withdraw only for research use of the data).

o Include information regarding what is done with data upon death of a participant. Return of Results [this is in part addressed in certain sections, below. However, it

might be clearer to create a separate section to detail how patients (or their family) will be able to receive or access their information]

o This section is generally required for genetic research studies, but certain aspects are also relevant to other types of biomedical research. Not all may be entirely relevant to eCCRB – however, it could be useful to include some information on how patients will have access to their results. In the specific case of genetic research, we usually, we divide this section into three types of results, namely:

Return of general research results: General results are aggregated results concerning a group or cohort of persons (can be return via newsletter, website, etc.).

Return of incidental findings: Incidental findings are unanticipated discoveries made in the course of research but that are outside the scope of the research (ex: discovery of another medical condition).

Return of individual research results: Individual research results are results discovered during the course of research, which concern an individual patient, and have potential health or reproductive impact.

o In the case of eCCRB, the main issue to address will likely be the return of individual results to patients and their family, via the research platform. However, do you anticipate there could be incidental findings generated through the research uses of eCCRB? Will general research results be returned to participants (ex: newsletters, information website on the research uses…)? Perhaps this warrants a discussion to clarify what the patient will receive beyond the clinical data entered into eCCRB.

Ethical Oversighto Include information regarding ethical oversight of the platform (ex: each site will

need to obtain local ethics approval prior to joining eCCRB) Data collection

o Include information on type of data that will be collected (data fields, when determined).

Closure of eCCRB platformo Include brief information on contingency plan if eCCRB were to cease activities

(ex: transfer of data to third party possible? Destruction of data? Site-specific decision?


Acronyms1RBW One Retinoblastoma World

AGM Annual general meeting

DePICT Disease-specific Electronic Patient Clinical Timeline

eCCRB eCancerCareRetinoblastoma

HIR Health Informatics Research

OC Operations Committee

PI Principal Investigator

SC Steering Committee

SickKids The Hospital for Sick Children

UHN University Health Network


Definitions Anonymized Data: data that have been irreversibly delinked from associated identifying

information.1 Circle of Care: individuals – both within and outside retinoblastoma treatment centers –

that provide retinoblastoma patient care (i.e., clinicians, allied healthcare providers, administrative support staff, and may include parents/ survivors).

Coded Data: data that have been reversibly delinked from identifying information, for the purposes of avoiding direct identification of the participant patient, with a code.1

Contributors Agreement: a document specifying the terms of eCCRB access and use. eCCRB Consortium Personnel: individuals that support the implementation, management

and operations of eCCRB. Ethics Review Committee: an independent committee for the ethical review of research

activities.1

Identifiable Data: data that alone or in combination with other data may reasonably be expected to identify an individual.1

One Retinoblastoma World: a global network of nearly 200 retinoblastoma treatment centers.

Pooled Data: data (anonymized or coded) from more than one site. Primary Site: when a retinoblastoma patient receives care at more than one site, a primary

site will be appointed. The primary site is the custodian of the patient’s data. Site: a retinoblastoma treatment center.



Could pooled data come from a single site but from many participants from that one site?


You might want to separate this into two different agreements:-Contributors agreement for sites providing data to eCCRB-Access Agreement for access to eCCRB data.


Who authorizes (or defines) the circle of care? Is this decided by the site lead (or other site-specific personnel?) Or does the patient/family have the right to limit or extend viewing of the data?

Figure 1. DePICT

eCCRB DePICT displays the entire treatment course for a child with “trilateral” retinoblastoma (both eyes and brain affected). This child required extensive treatment to achieve 11 year old disease-free survival.2

Governance of the eCancerCareRetinoblastoma Database

I. Background

Retinoblastoma:The management and treatment of children and families affected by a rare cancer of the eye (retinoblastoma) is a global challenge.2 Unusual complexities of this cancer include:

Heightened risk of second cancers which requires lifelong surveillance; 50% of patients have hereditary retinoblastoma which necessitates surveillance of

offspring and other relatives; Cancer Staging has not been standardized; Optimal management is complex, multidisciplinary and fragmented; Treatment can take years and require hundreds of clinical encounters; and Excessive focus on saving eye(s) can result in death.

The consequence of these complexities is 70% mortality worldwide, needless healthcare expense, and morbidity and loss of vision in the “developed” world where mortality is less than 5%. The eCancerCareRetinoblastoma (eCCRB) database will be a core tool going forward to address these retinoblastoma complexities.

eCCRB:eCCRB is an advanced, novel retinoblastoma point-of-care database that summarizes health record information from time of diagnosis. For over a decade, eCCRB has been a mainstay for retinoblastoma patient care at The Hospital for Sick Children (SickKids, Toronto, Ontario), and is used locally in some centers worldwide.

eCCRB was designed from retinoblastoma care guidelines, and point-of-care data entry reinforces these guidelines. A key function of eCCRB is a language independent visual summary of retinoblastoma care information (Disease-specific Electronic Patient Clinical Timeline, DePICT) (Figure 1). DePICT has been objectively proven to enhance clinical and



Perhaps it would be useful to add information right at the beginning that eCCRB will be used both for clinical purposes as well as for RB research.

family understanding of the retinoblastoma treatment course.3,4 Detailed information from individual clinical encounters is accessible in eCCRB through a simple point and click interface. Anecdotal feedback indicates that once doctors use eCCRB and experience how it simplifies their job – by giving rapid accurate understanding of the patient –they are highly motivated to input data at point-of-care.

Extensive feedback, resulting from years of eCCRB use at SickKids, led to the development of a second iteration of eCCRB, which is now housed on a secure Telus server.


Emily Kirby, 07/20/16,

As indicated above, it would be useful to have a separate section on data storage to specify where the server is located, security measures, etc.

II. Program Information

Overview:The second iteration of eCCRB is poised for global deployment. Oversight will be provided by the eCCRB Consortium.

Participating retinoblastoma treatment centres (sites) will, with patient/guardian consent, collect point-of-care data. All point-of-care data will be stored on the Telus server. Briefly, data access will be as follows (see Data Access below for more information):

Identifiable data will be available to everyone in the patient’s circle of care. Coded data will be available for research, under terms laid out in this document, beyond

the patient’s circle of care. Anonymized data will be available to researchers and other interested parties under

terms laid out in this document, beyond the patient’s circle of care.

Objectives:Identifiable data:

Support quality care for retinoblastoma based on guidelines; Enhance the understanding of the clinical encounters of an individual retinoblastoma

patient; and

Generate a language independent summary of retinoblastoma patient care for the guardian and survivor (i.e., DePICT).

Coded and anonymized data:

Collate clinical data for retinoblastoma patients globally; Conduct retinoblastoma research using a large number of patients, to support high-level

evidence-based care; and Evolve into a Learning Health System to inform - based on evidence - the care of any

child diagnosed with retinoblastoma.

Management:Health Informatics Research (HIR) within the Techna Institute at the University Health Network (UHN) developed the eCCRB software and will provide technical support. The overall management of eCCRB will be the responsibility of the elected eCCRB Consortium Steering Committee (SC).



Is this an open source software or is there a license agreement? Are there any provisions about custodianship of information entered into eCCrb?


Standard of care guidelines? Which guidelines?


Same question – opt-out possible?


Would it be possible for a patient to consent only to the sharing of data with the circle of care and opt-out of the research use component of eCCRB?


See comment above – who defines members of the circle of care? (for example, can a patient/parents request that certain people be given access to the data?)

III. Program Roles & Responsibilities

Participants: Participating sites and Researchers: Sites will be identified using existing retinoblastoma networks, namely One Retinoblastoma World (1RBW). All participating sites will sign a Contributor’s Agreement prior to eCCRB access.

Individuals within a retinoblastoma patient’s circle of care may access and use eCCRB. Site access use to of eCCRB is contingent on satisfying the requirements outlined in the Contributors Agreement and below (e.g., Quality Management & Privacy and Confidentiality).

Scientists Researchers may request coded (or anonymized) data from eCCRB for research aims, and will be required to sign a Data Sharing Agreement prior to obtaining access to data..



A preferable term could be researchers (in terms of applicable guidelines, there is usually a distinction between ‘clinic’ and ‘research’ – which is why we refer to “researchers” to tie this in to the applicable norms).


Would you require that members of the circle of care also have to enter an agreement (or confidentiality agreement) to view eCCRB data?


Access or, more generally, participating in eCCRB? (The term Access also refers to researchers requesting “access” to eCCRB data).


Usually the term Participants is used to mean the “research participants/patients” – so I suggest rewording to avoid confusion.

Roles and Responsibilities of eCCRB Consortium Committees:Please also reference the eCCRB Consortium Governance Diagram and the Role Based eCCRB

Access Matrix (Appendices I and II, respectively).

eCCRB

Consortium SC

The SC is responsible for all matters affecting the management of the eCCRB

database.

Who are the members?The SC will be constituted of:

Chair Site Leads

o A ratio of one Site Lead for every three participating countries will be maintained.

Project Manager IT Lead 1-2 Patient Representatives 1RBW Representative

Each member of the SC will have one vote.

The Operations Committee (OC) Membership Working Group will elect members to the SC. Membership will be for a 5-year term.

Who will lead the committee?The elected Chair will lead the SC.

What are the roles and responsibilities of the members?Specific responsibilities of the SC include:

Call at least one meeting per quarter (quorum will be four members); AppointSelect SC and OC Chairs on the basis of a majority vote; Ensure the SC is comprised of the aforementioned members; Define and monitor the scope of the project and project timelines; Ensure compliance with all legal and regulatory requirements; Oversee the development and maintenance of essential documents

(e.g., Contributor Agreement, Privacy Policy, Publication Policy etc.); Review complaints and non-compliance issues; Provide direction for site audits; Reconcile differences in opinion and resolve problems and disputes; Identify and mitigate potential risks; Monitor the quality of eCCRB database and data; Assign access privileges to eCCRB; Review and approve new site requests by consensus; Approve proposed eCCRB research; Create and oversee a plan for eCCRB funding; Oversee all eCCRB committees and working groups; and Coordinate with related projects.

eCCRB The OC reports to the SC and shall operate within the policies and strategic direction established by the SC.



As suggested during our call – we generally recommend that research access requests to eCCRB be managed by a separate Data Access Committee. This can help provide some independence to the review process (ex: adding members from the general research community that are not necessarily in the eCCRB steering committee). Also, it may reduce the burden on the Steering Committee, as depending on the number of requests, this may be a time-consuming tasak.


Would this be more appropriate for an Operations Committee (or personnel)?


Could part of this be delegate to the OC committee/working groups?


Perhaps delegate some of the more “operational” responsibilities to other committees – and keep the Steering Committee more general in nature? The responsibilities below seem a bit labour-intensive for a steering committee…


5-year term as well?

Consortium OC Who are the members?The OC will be constituted of:

Chair Site Leads Oncology and Ophthalmology Representatives ScientistsResearchers Allied Healthcare Representatives Project Manager Sites Coordinator IT Lead Privacy Officer Legal RepresentativeExpert Outcomes Specialist Patient Representatives 1RBW Representative

Who will lead the committee?The elected Chair will lead the OC.

What are the roles and responsibilities of the members?General responsibilities for the OC include:

Call at least one meeting per quarter; Call an Annual General Meeting; Ensure the OC is comprised of the aforementioned members; Plan and carrying out actions of the SC (e.g., deliverables identified in

the eCCRB scope and timeline); Seek approval from the SC as required; Ensure the SC is apprised of eCCRB activities and developments; Receive Research Proposals from the Sites Coordinator, ensure

completeness, vet, provide feedback (where necessary), provide to SC for review, and document; and

Participate in working groups.

The OC will be comprised of small working groups, each having a specific mandate and meeting schedule. Responsibilities of working groups will include (but are not limited to):

Membership: receive nominations for SC membership, coordinate voting for SC membership;

Data: conduct data quality checks, prepare data reports; Research: oversee consent process and organization, review

research and authorship requests to present to SC for approval (as per SC guidelines);

Funding: operationalize eCCRB funding plan and identify new opportunities for funding;

Implementations: identify new sites, prepare new site requests for SC approval, oversee new site implementation of eCCRB;

Privacy and Legal: ensure compliance with legal and regulatory



Does the OC need to approve proposed publications?


Delegate this to an Access Committee? To be discussed.


Quorum?


One year term?


Representative could also in certain cases refer to “Legal Counsel” which may not be the most appropriate person to sit on this committee.


However, you may want to reserve these experts for the Data Access Committee, if needed.

regulations for new and existing Sites, respond to inquiries about the eCCRB privacy policy;

Innovations: consider opportunities for ongoing eCCRB database development (e.g., patient/guardian reported outcomes, survivorship care plans).


Roles and Responsibilities of Personnel:

Site Leads

Number: Each participating site will appoint one Site Lead.Qualifications: The Site Leads will be Ophthalmologists, Oncologists or Scientists.Responsibilities (will include):

Participate in the SC and OC (and relevant OC Working Groups); Ensure compliance with Contributors Agreement (which specifies the

terms - such as legal and regulatory requirements - that must be met by all participating sites);

Ensure compliance with all eCCRB policies (e.g., Written Informed Consent Template and Protocol, Database Completion Guideline, Privacy Policy, Publication Policy, this governance document etc.);

Oversight of, and (site specific) advocacy for, eCCRB; Oversee requests for site data; Ensure all eligible patients are identified and approached for consent; Communicate with Database Manager for eCCRB technical support; Communicate all other issues to the Sites Coordinator including (but

not limited to) research and authorship requests, eCCRB feedback, data quality considerations, new site recommendations;

Participate in on-site and remote audits; and Ensure Sites Coordinator and OC/SC resolve issues satisfactorily.

Oversight: The Site Leads will be accountable to the Sites Coordinator and Database Manager.

OC and SC Chairs

Number: The SC and OC will each have one Chair. This may be the same individual.Qualifications: The SC and OC Chairs will be any member of the SC or OC, respectively. The Chairs will be nominated by the SC.Responsibilities (will include):

Provide leadership and oversight to the SC and OC.Oversight: The Chair(s) will be accountable to the SC.

Ophthalmology and Oncology

Representatives

Number: A specific number of Ophthalmology and Oncology Representatives is not required.Qualifications: Ophthalmologists and Oncologists that work in conjunction with Site Leads using eCCRB system (e.g., Clinical Fellows).Responsibilities (will include):

Participate in the OC (at the discretion of the relevant Site Lead) (and relevant OC Working Groups);

Alternate representatives for Site Lead at SC and OC meetings; Delegate for Site Lead responsibilities; and Use eCCRB in compliance with the eCCRB Database Completion

Guideline, Privacy Policy and this governance document.Oversight: The Ophthalmologist and Oncologist Representatives will be accountable to their respective Site Lead.



Will need to define eligibility criteria.


Are data requests managed centrally by eCCRB or would each site be able to vet and approve access requests?


Perhaps another term would be appropriate (by personnel, one might think that these are employees of eCCRB?) – actors involved? Any other suggestions?

ScientistsResearchers

members of the OC

Number: A specific number of Scientistsmember Researchers is not required.Qualifications: Any scientistsresearcher interested in studying eCCRB, retinoblastoma or the learning health system.Responsibilities (will include):

Participate in the OC (and relevant OC Working Groups); Delegate for Site Lead responsibilities.

Oversight: Scientists will be accountable to their respective Site Lead.

Allied Healthcare Representatives

Number: There will be one or more allied healthcare representatives.Qualifications: The Allied Healthcare Representatives may include (but are not limited to) Genetic Counsellors, Social Workers, Pathologists and Nurses.Responsibilities (will include):

Participate in the OC (and relevant OC Working Groups); and Use eCCRB in compliance with the eCCRB Database Completion

Guideline, Privacy Policy and this governance document. Oversight: The Allied Healthcare Representatives will be accountable to their respective Site Lead.

Site Data Coordinator

Number: Each participating site will appoint one Data Coordinator.Qualifications: The Data Coordinator will be a member of the clinical circle of care.Responsibilities (will include):

Ensure compliance with the eCCRB Privacy Policy; Ensure ongoing compliance with applicableall local and regional legal

and regulatory requirements; Ensure complete, accurate timely data entry (note that the intent is for

this point-of-care database to be used at the time of care provision by the clinician);

Identify privacy issues; Document all site complaints, privacy breaches and protocol

deviations and communicate to Site Lead; Securely store and document all signed written informed consent

forms; Ensure effectiveness of flags for patients who do not consent to their

data being used for research purposes; Provide preliminary eCCRB support for members of the circle of care at

his/her site; Report all issues (database performance, privacy, data quality etc.) to

the Site Lead; and Participate in on-site and remote audits.

Oversight: The Data Coordinator will be accountable to their respective Site Lead.



In this section, are we describing the member that is on the SC/OC? Or would this also be site personnel that uses eCCRB (without being a member of the SC/OC)? (Example, the Scientist section just above would then also need to refer to Scientists accessing eCCRB data…).


Would scientist necessarily be affiliated to a site or come they generally come from the broader research community?


Could you clarify what this means?

Project Manager

Number: There will be one Project Manager for eCCRB .Qualifications: The Project Manager will hold Master's degree in Epidemiology, Health Science or a related field with a minimum of three years’ experience in clinical research. Proven project management and leadership skills would be an asset.Responsibilities (will include):

Participate in the SC and OC; Work collaboratively with Database Manager; Ensure project timelines (as set by SC) are met; Coordinate all SC and OC meetings; Oversee progress of OC Working Groups; Maintain scope of the project (as defined by SC); Ensure compliance with this governance document; Oversee project budget; Create the eCCRB Written Informed Consent Template and Protocol; Identify relevant experts that can support the project aims; Provide direction and support to eCCRB Consortium Personnel

including Sites Coordinator, Privacy Officer and Legal Representative.Oversight: The Project Manager will be accountable to the SC.

Sites Coordinator

Number: There will be one Sites Coordinator.Qualifications: The Sites Coordinator will hold a Master's degree in Epidemiology, Health Science or a related field with a minimum of three years’ experience in clinical research. Supervisory skills and leadership experience will be an asset.Responsibilities (will include):

Participate in the OC (and all relevant OC Working Groups); Coordinate all elements of new site implementation of eCCRB; Retain a copy of the signed Contributors Agreement and current

consent form used at each site; Under the direction of the Project Manager, function as a conduit for

all Site Lead questions, feedback, recommendations etc. (with the exception of time sensitive database support which is directed to the Database Manager):

o Research proposals: ensure completeness, provide preliminary feedback, present to the OC for review;

o Privacy breaches: ensure completeness, provide preliminary feedback, provide to the Privacy Officer and Project Manager;

o Suggested data field changes: ensure completeness, provide preliminary feedback, provide to the IT Lead.

Provide relevant information to participating sites; Receive new site requests. (New sites will be granted access to

eCCRB by consensus of the SC); and Recruit new sites.

Oversight: The Sites Coordinator will be accountable to the Database and Project Managers.

IT Lead Number: There will be one IT Lead.



Who will manage copies of the signed Data Sharing agreements?

Qualifications: A member of HIR at Techna InstituteResponsibilities (will include):

Participate in the SC and OC (and all relevant OC Working Groups); Design data model for defined core data set; Develop workflow for data entry, import and access; Maintain database and user interface; Maintain a log of all actions carried out on eCCRB; Receive suggested changes in data fields (from the Sites

Coordinator), present recommendation to SC (if agree with recommendation), and document;

Develop, maintain and implement Role-Based eCCRB Access Matrix as per SC; and

Develop (with the SC) and maintain Database Completion Guideline.Oversight: The IT Lead will be accountable to the SC.

Database Manager

Number: There will be one Database Manager.Qualifications: A member of HIR at Techna Institute.Responsibilities (will include):

Prepare technical documentation on eCCRB use; Oversee eCCRB training for users at participating sites; Provide support during business hours; Provide timely feedback; Resolve and document issues; Communicate upgrades and downtime procedures; Prepare data reports; Retrieve data for research aims approved by the SC; and Provide direction to eCCRB Consortium Personnel including Sites

Coordinator, Privacy Officer and System Administrator.Oversight: The Database Manager will be accountable to the IT Lead.

System Administrator

Number: There will be one System Administrator.

Qualifications: A member of HIR at Techna Institute.

Responsibilities (will include): Develop and maintain server configuration; Perform regular backups; Develop and communicate upgrades; and Ensure downtime procedures.

Oversight: The System Administrator will be accountable to the IT Lead.


Privacy Officer

Number: There will be one Privacy Officer.Qualifications: The Privacy Officer will hold a Master's degree in Ethics, Epidemiology, Health Science or a related field with a minimum of three years’ experience in clinical research. Experience with research privacy would be an asset.Responsibilities (will include):

Participate in the OC (and all relevant OC Working Groups); Periodic review of provincial and federal privacy regulations; Develop (with the SC), maintain, the eCCRB Privacy Policy in

accordance with applicable provincial and federal privacy privacy regulations;

Oversee development of all necessary generic privacy documents including, where required, Privacy Impact Assessments and Data Sharing Agreements;

Provide direction and ongoing support to new sites pertaining to all privacy matters;

Receive notice of privacy breach or issues (from the Sites Coordinator) and communicate (promptly - no more than 10 business days) to SC in a report including corrective and preventive action, and document; and

Respond to all inquiries pertaining to the eCCRB privacy practicesOversight: The Privacy Officer will be accountable to the Database and Project Managers.

Legal Representative

Number: There will be one Legal RepresentativeExpert.Qualifications: The Legal Representative Expert will be a lawyer or student.Responsibilities (will include):

The Legal Representative Expert will be contacted as needed by the SC Chair, or delegate.

Oversight: The Legal Representative Expert will be accountable to the SC.

Outcomes Specialist

Number: There will be one Outcomes Specialist.Qualifications: The Outcomes Specialist will be a Biostatistician.Responsibilities (will include):

Participate in the OC (and all relevant OC Working Groups); Provide feedback on research proposals, namely statistical analysis

plans; Ensure core data set includes the appropriate elements to meet

research objectives; Define queries to meet research objectives; and Generate outcome measures.

Oversight: The Outcomes Specialist Awill be accountable to the OC.



Does this refer to approval of proposals submitted by researchers? Is this a formal approval?


Do you intend the legal representative to be a “Legal Counsel” – or rather someone who can guide on legal/ethical issues?


Again, if international, this may not be feasible for all sites. Perhaps simply refer to support in relation to the privacy policy.


Since eCCRB will be international – best to refer to general privacy principles (rather than jurisdiction-specific ones).


Who will review international privacy regulations? Perhaps add a note that for international sites, the site lead will be responsible for ensuring compliance.

Patient Representatives

Number: A specific number of Patient Representatives is not required. A diverse group of Patient Representatives is desired to reflect the many different experiences of those affected by retinoblastoma globally.Qualifications: Retinoblastoma survivor, family member affected by retinoblastoma or retinoblastoma patient advocate.Responsibilities (will include):

Participate in the SC and OC (and relevant OC Working Groups);o 1-2 Patient Representatives will be elected to the SC.

Oversight: Patient Representatives will be accountable to the OC.

1RBW Representative

Number: There will be one 1RBW Representative.Qualifications: 1RBW founding member, Chair or delegate.Responsibilities (will include):

Participate in the SC and OC (and relevant OC Working Groups).Oversight: The 1RBW Representative will be accountable to the OC.


IV. Quality Management

Minimum Input Required: eCCRB is a point-of-care database for both clinical and research use. Most effectively,

patient information will be entered at the time of care provision by the clinicians (i.e., Ophthalmologist, Clinical Fellow, Oncologist) or allied healthcare providers.

Data entry will be completed within a week of the patient encounter. Site Leads are responsible for the data entered at their site into eCCRB. The SC will determine the minimum data required.

Data Entry Quality Control: Written informed consent from the parent or legal guardian, and where required, assent

from the minor, will be obtained before any information concerning the patient is entered into eCCRB.

The Site Lead will ensure data quality and compliance with the eCCRB Database Completion Guideline.

Data quality obligations include, but are not limited to:o Accurate, timely, precise data entry in accordance with the Database Completion

Guideline;o Extensive data validation;o Prompt complete correction of all inaccurate information; ando Comprehensive feedback to Database Manager about any performance issues

and unresolved data inaccuracies. When a retinoblastoma patient receives care at more than one site, the Site Leads

(from the treatment centers providing the patient’s retinoblastoma care) will negotiate and appoint a primary site. (See Data Access below for more information.)

o The primary site is the custodian of the patient’s data. o The primary Site Lead is responsible for the patient’s data entry, with expansion

of the patient-specific circle of care to include the second Site. Sites agree to audits (on-site and remote) to verify data quality, review regulatory

approvals, participant consent and eCCRB privacy and security. o Audit procedures will be developed by the SC. Audits will be by peer review.

Should the Database Manager, or other member if the eCCRB Consortium (i.e. following an audit), request a data modification, the following information will be logged:

o Person requesting changeo Date of the requested changeo Details about the change.o If the request was carried out or deniedo The person implementing the changeo The time of the change implementation

Data Access: A Role Based eCCRB Access Matrix has been created and will be maintained by the IT

Lead as per the instructions of the SC (see Appendix I). As detailed below, access to identifying patient data is restricted to the patient’s circle of

care and database support personnel from HIR (i.e., IT Lead, Database Manager and


System Administrator).

A. Access for Patient Care: o A patient may receive care from the following, collectively called the patient’s

circle of care: Personnel within the patient’s primary site (defined above); Personnel within other sites; and Personnel providing care outside of a site (e.g., family physician).

o The circle of care may also include parents and retinoblastoma survivors.o Varying levels of access will be provided to the circle of care based on their role. o The Site Lead from the primary site will have the unique ability to reappoint a

new primary site.o All Site Leads within the patient’s circle of care will have the ability to provide

data access to other members within the circle of care.B. Access for Database Oversight:

o The IT Lead, Database Manager and System Administrator will have read-write access to all global and site data, as required for eCCRB maintenance.

o The SC, OC, Sites Coordinator, Project Manager and Outcomes Specialist will have access to global and site coded data.

C. Access for Research:o The individual initiating the research objective (named as Principal Investigator

(PI) hereafter), will be responsible for submitting a research proposal.o Research using data from (patients that received retinoblastoma care at) one

site, will be under control of the Site Lead. These research projects will be communicated to the Sites Coordinator (for tracking and documentation purposes only, no formal approval required).

o Research proposals involving pooled (anonymized or coded) data (i.e., data from > 1 site) will be submitted to the Sites Coordinator.

o Research proposals will include, but are not limited to, all necessary data fields and a statistical analysis plan.

o The Sites Coordinator (under the direction and guidance of the Project Manager) will review the research proposal, provide preliminary feedback, ensure information is sufficient and share the proposal with the OC.

o All research objectives involving pooled eCCRB data (i.e., data from > 1 site) will be vetted by the OC and then approved by the SC.

o PIs will be members of the OC.o Sponsors cannot be PIs.o PIs can appoint another individual to (under the direction of the PI) oversee the

research endeavor (and, as per the Authorship section, this person may be the first author).

o Before a new research objective is submitted for approval, the expectation would be that prior projects by that PI are completed or nearly complete.

o In the event that more than one site wishes to lead on a given question, the involved sites will be asked to resolve the leadership. If the parties involved cannot reach resolution, the SC will identify the PI.

o Data extraction for pooled data will be performed centrally, by the Database Manager or delegate, after all legal and regulatory approvals are obtained by the



Does this mean no commercial access? Or just eCCRB funders?


So… different mechanisms for pooled vs. one site? What about coded data - does the OC and SC also vet? Would be simpler if all requests are handled by one committee unless you think sites would oppose to this.


See previous questions regarding centralization of approval of requests vs. each site examining the proposals.


See previous question – could data be pooled from a single site (but with several patients)?


Question mentioned above: Who approves access requests? Is each site responsible for approving access requests involving its data? What if data comes from several sites (coded, but not pooled)?


This will need to be developed. Are we creating a separate committee to examine requests?


See comment above – can patients/family extend the circle of care? Or is this solely under the responsibility of the Site Lead?


This will need to be detailed.

PI, including research ethics review committee approval from the PI’s site.o Data analysis for pooled data will be conducted locally.o Collaboration with, and contribution of data to, external institutions/research

groups will be considered on a case-by-case basis by the SC. o Site collaboration with (and contribution of data to) external institutions/research

groups is at the discretion of the Site Lead.D. Access Other:

o Data queries concerning anonymized data from (patients that received retinoblastoma care at) one site, will be under control of the Site Lead.

o A protocol will be established by the SC - stipulating data extraction procedures, including required signoff - for pooled anonymized data requests that are not associated with research.



Needs to be clarified – this process seems quite complicated if there is a possibility of centralizing the access requests (and sites do not oppose to this). (We can make a proposal on this in next version).


Is there a possibility of using the eCCRB database to recontact participants to conduct studies?


What if accessing pooled data? Needs to be clarified… This will be quite complicated for external researchers to access (if permitted).

V. Publications The following guidelines apply to all retrospective and prospective studies emanating from pooled eCCRB data:

Publications will be in accordance with the eCCRB Publication Policy. Authorship will be in accordance with international authorship and publication

guidelines, and the guidelines described below. The PI for each research objective will be responsible for timely publication. Manuscripts will be submitted no more than 12 months after SC approval; extensions

may be granted, where warranted. If the SC determines that publication is not occurring in a reasonable time frame

(without just cause), a new PI will be identified. Should this occur, all participants agree to provide data analysis and/or report to the new PI.

All authors should have the opportunity to review and comment on the analysis and content.

Should a significant difference in opinion be present in the interpretation of the data, a resolution should be obtained by majority vote amongst the authors.

Authorship: The PI should prepare a concise written description of how the authorship was decided

for submission to the OC. Authorship will be based solely on contribution to the research project (e.g., significant

participation in developing the research, writing, data entry or data analysis). Authorship order:

o Corresponding author: PIo First Author: author who contributed the most to the research project after the PIo Other Authors: in accordance with contribution to the research project

eCCRB and any patient organizations involved in the SC will be acknowledged in all publications using data from eCCRB (i.e., pooled, or site-specific analyses).

Sponsors will be acknowledged as supporters but not collaborators or contributors.



Same question as above – by Sponsor do you mean eCCRB sponsors? Or commercial sponsors of any research using eCCRB?


Will the OC vet the publication? (This will probably be detailed in the Publication Policy…) – To be discussed.


Both the SC and OC need to approve publications? (See comment below).


What do you mean by retrospective and prospective studies?


We should add some Intellectual Property guidelines as well. We will re-work this section.

VI. Privacy and Confidentiality Each site will comply with the eCCRB Privacy Policy and meet their local, provincial

regional, and national and international legal and regulatory requirements, including those related to the protection and security of personal information, prior to entering any information into eCCRB.

Compliance with privacy norms and regulations Privacy at each site will be the responsibility of the Site Data Coordinator (under the supervision on the Site Lead).

Any privacy breaches or issues regarding eCCRB should be communicated by the Site Lead to the Sites Coordinator within 10 working days.

The Sites Coordinator (under the direction and guidance of the Project Manager) will review the submission, ensure information is sufficient, provide preliminary feedback and promptly notify the Privacy Officer.The Privacy Officer will – in a timely manner (i.e., no more than 10 business days) – verify privacy issues and communicate to SC in a report including corrective and preventive action.

Written Informed Consent: Written informed consent will be obtained before any information concerning the patient

is entered into eCCRB. The written informed consent form, and the consent process, at each site will comply

with the eCCRB Written Informed Consent Template and Protocol as well as the policies specific to that site and local and provincial regulations.

The Site Lead will provide the Sites Coordinator a copy of the current written informed consent form used at that site.

The relevant signed consent form(s) will be available for viewing on the patient’s eCCRB.



Available to who? This should perhaps be restricted… How will eCCRB interact with the medical record? Will consent information be place only in eCCRB or will it also appear in the medical record?


Is privacy officer’s role different?

VII. Financial Management

Data Entry: eCCRB is a point-of-care database, that is intended to be integrated into routine care to

support quality care for retinoblastoma, and can be used by approved researchers, conducting research on retinoblastoma. There will be no remuneration for data entry into eCCRB.

Fundraising: The SC will be responsible for obtaining funding to maintain the overall viability of the

project (e.g., technical contracts, eCCRB Consortium Personnel remuneration etc.). The Project Manager will oversee the project budget. All local site costs associated with the use of eCCRB, including remuneration for Site

Data Coordinator, are the responsibility of the respective retinoblastoma treatment centre.


VIII. Sponsors Management Sponsors will not participate in the SC or OC. Sponsors will not have access to any identifiable or patient-level data. Sponsors will not be able to query the database. Sponsors may suggest new research aims. The OC will have discretion to determine if

the question is in scope and of interest. Sponsors cannot be PIs. Sponsors will not be acknowledged as authors in publications. Sponsors can only be

acknowledged as supporters and not collaborators or contributors. Sponsors cannot prevent publication of results.



Who do you include/define as sponsors? (If Telus – I would also check your contract to verify whether Telus has access to data stored on services – for audit/quality control, etc…This might slightly influence this section).

IX. Data Field Changes Data fields can be changed. The Site Leads will communicate to the Sites Coordinator suggested data field changes. The Sites Coordinator will then review the suggestion, ensure information is sufficient,

and communicate this information to the IT Lead for consideration. If the IT Lead agrees with the suggested data field change, they will present this

information to the SC for approval. The IT Lead will determine the optimal data management for those data collected prior

to the field change. Where appropriate, data collected prior to the field change will be migrated, as into the new field.

All suggested data field changes, and their outcome, will be recorded by the IT Lead. The IT Lead will respond to all suggested data field changes.


X. Risk & Security Management Database architectural security mechanisms will be updated and maintained by the IT

Lead (or delegate). eCCRB will store point-of-care, identifiable patient data. Care-givers who are in the circle

of care of a patient will have access to view and update the patient record. Access to eCCRB will be password protected. Access to patient information and forms

will be restricted (see Section IV. Data Management, Data Access above). Users will log in and enter a password (at least 8 characters long, contain at least 1

capital letter, and at least 1 number); a two-step process will then provide to the user a one-time additional password to access the system.

Actions carried out with information and actions related to the management and operation of eCCRB will be logged at all times.

Electronic logs will be maintained at UHN including:o Database changes; o User logins; o Database interactions; o Audit trails on important actions, such as viewing reports; and o System errors.

Communications on security and privacy policies and updates will be done through notifications within the regular eCCRB updates channels.

Urgent communications will be sent by e-mail to participating sites. If an isolated incident occurs, the IT Lead (or delegate) will contact affected users by e-

mail or phone to clarify the situation. All new users will be shown security and privacy policies and expected conduct, with

appropriate sign-off and audit. The server administrator will ensure that regular system backups are performed. Restrictions will limit simultaneously data entry in one patient record. UHN-adapted security mechanisms will protect eCCRB system from internal and external

threats and vulnerabilities. The eCCRB system has several technical features that help with security:

o Secure Sockets Layer encryption that hides the data, in case it is intercepted by a 3rd party during transmission;

o Automated filtering/cleaning of user input to prevent Structured Query Language injection attacks;

o Users are required to enter in a password to initiate access to the system with a one-time use secondary password;

o Automatic log-out after a period of user inactivity;o POST variable passing along with a key to identify that it is from a reliable

source; ando Session management will prevent cross-talk between session variables.

The eCCRB security analysis will be produced by the Privacy Officer and will be used as a guide for the security requirements.

Legal issues will be referred to the SC who will work in conjunction with legal counsel to address each issue.



More details on storage will be required. Ex: centrally stored? Location? Duration of storage? Destruction?


Will also need to include a section on risk to patients (ex: informational risks, etc.). Also include benefits. Section will be re-work to split risks into different types. I also suggest to move some of the content in this section in a section on Storage conditions (or sub-sections).

XI. Performance Management Complaints and non-compliance issues should be sent the SC Chair. The SC will conduct a yearly review of the role-based eCCRB access matrix. An annual general meeting (AGM) will be coordinated by the OC.

o The AGM will be chaired by the SC Chair.o Members will be invited to raise issues to the chair prior to the meeting.


XII. References1. Global Alliance for Genomics and Health. Data Sharing Lexicon. Canada, 2016.

2. Dimaras H, Corson TW, Cobrinik D, et al. Retinoblastoma. Nat Rev Dis Primers 2015; 1: 1-22.

3. Chiu HH, Dimaras H, Downie R, Gallie B. Breaking down barriers to communicating complex retinoblastoma information: can graphics be the solution? Can J Ophthalmol 2015; 50(3): 230-5.

4. Panton RL, Downie R, Truong T, et al. A visual approach to providing prognostic information to parents of children with retinoblastoma. Psycho-oncology 2009; 18(3): 300-4.


XIII. Appendices

Appendix I: eCCRB Consortium Governance Diagram:


Appendix II: Role Based eCCRB Access Matrix:

* Extremely rare occurrences† Additional circle of care roles will exist

‡ Restricted fields only


Personnel Identifiable Coded AnonymizedRead Write Read Read

eCCRB Consortium Personnel: Role Based Access to All DataTechnical Support

IT Lead √* √* √ √Database Manager √* √* √ √

System Administrator √* √* √ √SC

SC Chair X X √ √SC Site Leads X X √ √

Project Manager X X √ √SC Patient Representatives X X X √

1RBW Representative X X X √OC

OC Chair X X √ √OC Site Leads X X √ √

Oncology and Ophthalmology Representatives X X √ √Scientists X X √ √

Allied Healthcare Provider Representatives X X √ √Sites Coordinator X X √ √

Privacy Officer X X X √Legal Representative X X X √Outcomes Specialist X X √ √

OC Patient Representatives X X X √Circle of Care: Role Based Access to Patient Data†

Site Leads √ √ N/A N/ASite Data Coordinators √ √ N/A N/A

Genetic Counsellors √ √‡ N/A N/AAdministrative Support Staff √ √‡ N/A N/A

Family Physicians √ √‡ N/A N/A

Date post:	15-Feb-2020
Category:	Documents
Upload:	others
View:	0 times
Download:	0 times

· Web viewAcronyms3. Definitions4. Background5. Retinoblastoma5. eCCRB5. Program Information7....

Documents