A:
PII and personal health information can only be shared with researchers that receive an approved Data Sharing Agreement from DHA’s Privacy and Civil Liberties Office. A DSA is an administrative control used by DHA to document that the requested use of data is in compliance with all federal laws and DOD policies.
The DSA documents the responsibilities of the requestors, including the government sponsor and applicant/recipient. The DSA also confirms that DHA data will be used as permitted or required, and it exercises administrative, technical, and physical safeguards to protect the privacy of PHI, as required by the Health Insurance Portability and Accountability Act. The DSA determines the HIPAA-defined category of data intended for use (i.e., protected health information, a limited data set, or de-identified PHI). HIPAA permits a covered entity to use or disclose a limited data set for research, public health, or health care operations purposes. The DSA also maintains records to confirm compliance in case of an investigation.