​DHCS Review and Approval Process

All external confidential data requests for research or public health purposes will be reviewed by California Department of Health Care Services (DHCS) Data and Research Committee (DRC). The DRC's role is to make recommendations to DHCS executive management regarding the potential approval or denial of an external confidential data request. 

The DRC is comprised of DHCS program policy staff, Privacy Officer (PO), and research staff.

The DRC review and approval process involves numerous steps.

1. The Principal Investigator (PI) submits the following:

• Completed application packet which consists of a signed and dated Application form
• Completed Data Table
  
• Completed but unsigned Data Use Agreement
  
• One-page Executive Summary
  
• Copy of the Committee for the Protection of Human Subjects (CPHS) approval and research protocol*
  
• Copy of the PI's curriculum vitae. A curriculum vitae may not be required for public health requests.
  

  * Note: This is a separate application and approval process required through the State of California’s Institutional Review Board and can be completed simultaneously with the DRC review process. At a minimum, the PI must request the following approvals from CPHS:

  • HIPAA Waiver
  • Senate Bill (SB)-13 (Information Practices Act)

  • Informed Consent Waiver (45 CFR 46.116(e)). Required in cases where the PI researcher plans to contact any of the subjects to have a “face to face” discussion.
    

  CPHS approval may not be required for “public health” data requests and will receive a CPHS exemption. Any modifications and/or suggested improvements made during the DRC review process must be communicated to CPHS by updating the CPHS protocol.
  
  

2. Upon receiving a complete application packet, the DRC initiates an internal review process and includes DHCS PO and DHCS assigned research staff who are responsible for compiling and releasing the data file(s). This intern​al, concurrent review will take approximately two to four weeks. All the evaluations are taken into consideration during the DRC meeting.
   

   Note: The PI may be contacted by DHCS staff to provide clarity and revisions to the data request, if needed.
   

3. The following criteria will be use​d by the DRC and DHCS research staff when reviewing a data request (research or public health):

   • Program Relevance - Usefulness of potential findings to DHCS, potential health impact on DHCS’ beneficiaries and the general public, and the project focuses on a topic that will provide new and useful information to DHCS programs.
   • Methodology - Refers to DHCS’ assessment of the reliability, accuracy, and practicality of the proposed methodology in answering the identified research or public health question(s).
     
   • Risk Assessment - Identifies the potential risk to security and confidentiality of releasing the requested data file(s).
     
   • Department Impact - Indicates the number of resources DHCS will need to expend to fulfill the data request and to assist the PI.
   • Investigator Qualifications - DRC's assessment of the PI’s experience and qualifications.
     
     

4. Prior to the DRC meeting, DHCS research staff will meet with the PI to discuss the new data request.

5. Next, the PI will formally present their data request to the DRC. The DRC meets every other month to review new applications and discuss the feedback received from the DHCS PO and research staff, that will compile the data file(s). 
   

6. The DRC proposes either an “approval” or “denial” recommendation for the data request to the DHCS Chief Data Officer (CDO). 

7. DRC staff will communicate the CDO’s final decision to the PI. The PI will receive this decision approximately one month after the DRC meeting.

8. If the request for the research data is approved, the data are prepared for the PI and DHCS arranges the data release to the PI. The time needed for the data release process varies according to the workload within DHCS at the time of approval. The PI will be charged for applicable costs incurred as a result of the time needed to prepare and release the appropriate data file(s).

9. Data Use Agreements (DUAs) need to be renewed every year (a DUA expires annually).
   

   • The PI is required to conduct yearly presentations to DHCS staff and the DRC regarding the project’s progress.
   • At the time of the yearly progress reporting, the PI must apply for a DUA renewal and provide copies of any publications resulting from the project.
     
   • At the project’s conclusion, the PI is required to 1) destroy, or 2) return to DHCS any data file(s) containing personally identifiable information, and 3) submit a Data Destruction Certificate.​
     
     

10. The PI is required to submit a copy of their journal article abstract or other publications if any findings are published from their research using Medi-Cal data.​