650-20: Interim: External Sharing of Personally Identifiable Information (PII) and PII-Derived Data

Comments on interim Campus Administrative Policy 650-20 are currently under review.

To establish policies and procedures for sharing UCSF-owned Personally Identifiable Information (PII) and PII-Derived Data with entities and individuals external to UCSF.

UCSF recognizes the importance of safeguarding UCSF-owned PII and PII-derived data in order to protect the privacy of individuals who interact with the University. When sharing UCSF-owned data with external entities, UCSF is committed to ensuring compliance with applicable federal and state privacy laws and regulations.

Additionally, it is UCSF policy to restrict certain legally permissible external sharing of UCSF-owned PII and PII-derived data if sharing the data may harm individuals or University interests. For example, in accordance with this policy, UCSF may restrict the disclosure of de-identified PHI to an external recipient in certain cases that would otherwise be permitted by the HIPAA Privacy Rule.

1. Oversight and Governance
   To ensure appropriate oversight and governance, all external sharing of UCSF-owned PII and PII-derived data must be reviewed in advance by a Contracting Unit unless at least one of the following exceptions apply:
   1. Disclosure of PHI by UCSF Medical Center for purposes specifically permitted by UCSF Medical Center Policy 5.02.01 Confidentiality, Access, Use, and Disclosure of Protected Health Information and Privacy. This includes disclosures of PHI to other HIPAA CEs and Business Associates for treatment, payment, and health care operations. Important note: UCSF Medical Center may disclose PHI for research purposes if also permitted by IRB policies; however, a UCSF researcher may not subsequently share data with an external recipient prior to review by a Contracting Unit in accordance with this policy.
   2. External sharing authorized in writing by all individuals whose information is included in the PII or PII-derived data. HIPAA Authorization forms and/or IRB-approved Informed Consent Forms may constitute the required written authorization, providing the external data recipient is specifically named.
   3. Specific data sharing arrangements approved by the IT Governance Committee on Enterprise Information & Analytics (EIA).
   4. When reviewing external data sharing requests, all Contracting Units will follow the procedures available at Supporting Secure Data-Sharing Partnerships | UCSF Data Resources.
2. Contracting Requirements
   1. Data Sharing Requests. UCSF Community members must request review from an authorized Contracting Unit prior to sharing UCSF-owned PII or PII-derived data with an external party, unless an aforementioned exception applies.
   2. Contracting Requirements. Contracting Units are responsible for ensuring all of the following requirements are satisfied prior to UCSF-owned PII or PII-derived data being shared with external parties:
      1. The data sharing arrangement supports an articulated public benefit and/or UCSF core mission.
      2. Any data sharing to foreign countries complies with the obligations as described in https://data.ucsf.edu/data-sharing.
      3. A data sharing agreement is executed in writing between UCSF and any external recipient of UCSF-owned PII or PII-derived data. Data sharing agreements may include, but are not limited to, Sponsored Clinical Trial Agreements and Data Use Agreements. Data sharing agreements must include the following minimum terms:
         1. Contains the right for UCSF to terminate without cause;
         2. Requires recipient to destroy or return data at conclusion of agreement term or upon request by UCSF;
         3. Prohibits any re-identification of individuals;
         4. Prohibits further transfer of any data without prior written approval from UCSF;
         5. Prohibits commercialization of the data;
         6. Requires that data be protected by all applicable privacy laws;
         7. Specifically identifies the information technology security controls that will be applied;
         8. Requires data recipient to provide evidence of compliance with the data sharing agreement upon request by UCSF;
         9. Provides audit rights to UCSF to ensure compliance by data recipient;
         10. Requires data recipient to promptly report breaches to UCSF;
         11. Requires data recipient to maintain insurance in the amounts of $1M per occurrence and $2M in aggregate, as well as cyber insurance; and
         12. Requires data recipient to indemnity UCSF for its negligent acts and omissions, as well as indemnify UCSF for any breach attributable to data recipient. 
      4. The proposed data sharing arrangement, in the judgement of the Contracting Officer, presents unusual or unreasonable risk to individuals or UCSF.
         Upon satisfaction of the above requirements and execution of a data sharing agreement, UCSF-owned PII and/or PII-derived data may be shared with the external party. If any of the above requirements is not met, the Contracting Unit will escalate the data sharing request to the EIA Committee for review.

   3. EIA Committee Escalation Protocol: When a data sharing arrangement is escalated as previously described, the EIA Committee may take one of the following actions:

      1. Approve the data sharing arrangement by waiving certain Contracting Requirements listed above, as follows:
         1. The EIA Committee may waive Contracting Requirements 2(c) and/or 2(d), in whole or in part, after conducting a thorough risk-based assessment of individual privacy rights and UCSF institutional interests. Important note: the requirement to execute a data sharing agreement may only be waived if: (i) an agreement is not otherwise required by law, regulation or policy (e.g., de-identified PHI); and (ii) relinquishing ownership and control of the data does not unreasonably interfere with individual privacy rights nor UCSF’s institutional interests.
         2. The EIA Committee may not waive Contracting Requirements 2(a) or 2(b). The EIA Committee may approve the data sharing arrangement contingent upon the completion of additional requirements necessary to protect individual privacy or University interests.
         3. Disapprove the data sharing arrangement. The Committee will document specific justification for the disapproval.
         4. Refer the data sharing arrangement to the Chancellor’s Executive Team for approval or disapproval.

      The EIA Committee will communicate its action to the appropriate Contracting Unit and/or data sharing requester. If the EIA Committee approved the data sharing arrangement contingent upon the completion of additional requirements, the data requester is responsible for ensuring all requirements are met prior to sharing any data with an external party. If the data requester wishes to appeal the EIA Committee’s action, the requester may inform the EIA Committee and the data sharing arrangement will be escalated to the Chancellor’s Executive Team for final approval or disapproval.

The Office of IT Enterprise Information & Analytics is responsible for this policy.

• Health Insurance Portability and Accountability Act (HIPAA) [Title 45 Code of Federal Regulations Parts 160, 162 and 164]
• University of California Policy HIPAA Administrative Requirements
• UCSF Medical Center Administrative Policies:
  • 1.02.15 HIPAA Business Associates
  • 5.02.01 Confidentiality, Access, Use, and Disclosure of Protected Health Information and Privacy