​​​DHCS Review Process

All data requests for research or public health purposes will be reviewed by DHCS’ Data and Research Committee (DRC). The role of the DRC is to make recommendations to DHCS executive management regarding the potential approval or denial of a data request. The DRC oversees the process for soliciting and responding to requests from external requestors for access to protected DHCS data and assesses the appropriateness and priority of data releases for research or public health purposes.

1. The requestor submits a completed application packet which consists of a signed and dated Application form, a completed Data Table, a filled out Data Use Agreement, a copy of the Committee for the Protection of Human Subjects (CPHS) approval and research protocol, and a copy of the researcher’s curriculum vitae. A curriculum vitae may not be required for public health requests.

2. Upon receiving a complete application packet, the DRC initiates an internal review process involving program staff, the privacy officer, and the DHCS entity that will release the data files. This internal simultaneous review will take approximately 2-4 weeks. The requestor will most likely be contacted by any of the DRC internal reviewers, if necessary. ​

3. The following criteria will be used by the DRC when reviewing a research or public health data request:

   • Program Relevance: This includes the usefulness of the potential findings to DHCS, the potential health impact on DHCS’ beneficiaries and the general public, and whether the project focuses on a topic that will provide new, useful information to DHCS programs.
   • Methodology: This refers to DHCS’ assessment of the reliability, accuracy, and practicality of the proposed methodology in answering the identified research or public health question(s).
   • Risk Assessment: This refers to the potential risk to security and confidentiality of releasing the requested data sets.
   • Department Impact: This refers to the amount of resources that DHCS will need to expend to fulfill the data request and assist requestors.
   • Investigator Qualifications: This refers to the DRC's assessment of the investigator's experience and qualifications.
4. The DRC meets every three months to review applications and the feedback received from the DHCS’ privacy officer, program staff and data holder. Requestors will most likely be contacted by the DRC if further information is needed. 
5. The DRC forwards its recommendation for approval or denial of the data research request to the Director’s Office.
6. The DRC staff communicates the Director’s Office decision to the requestor.  It is anticipated that the requestor will most likely receive this decision no more than three months after receipt of a completed application packet. Please note that if the request for research data is approved by DHCS, a separate application must be submitted to the California Health and Human Services Agency (CHHS) Committee for the Protection of Human Subjects (CPHS) (Not DHCS).  CPHS approval may not be required for public health requests.
7. Researchers will submit a copy of the CPHS approval letter and protocol.  A copy of these items are required before the data release.
8. If the request for the research data is approved, the DRC administrator will notify the DHCS entity holding the data file, who will arrange for the data release to the requestor.  The time needed for the data release will vary according to the workload level within DHCS.  The requestor will be charged for applicable costs incurred as a result of the time needed to prepare and release the appropriate data files.  Please note that there is time delay in the data from when DHCS receives protected health information from the health plans.  Depending upon the time​frame being requested, there may be a delay between six to eighteen months after the date of service before DHCS data is considered to be complete.  Data is currently only available as far back as October 2004.
9. Data users will be required to conduct yearly presentations to DHCS staff and to the DRC regarding the progress of projects.  At the time of the annual progress reporting, data users must also apply for renewal of the Data Use Agreement (DUA) and are expected to provide copies of any publications resulting from the project.  At the conclusion of the project, the data user is required to destroy or return to DHCS any data files containing personally identifiable information.
10. Researchers are required to submit a copy of their journal article abstract or other publications if they publish any findings from their research using Medi-Cal data.