Northwestern University Feinberg School of Medicine
Northwestern University
Clinical and Translational Sciences Institute

A CTSA partner accelerating discoveries toward human health

Skip to main content

Permissible Use Policy FAQ

The official policy regarding permissible use on NMEDW is laid out in the frequently asked questions below.

Policy Questions

 Does the permissible use policy apply to me if my IRB-approved protocol allows the study team to login to the EMR in order to copy data?

Yes, this policy applies, even if the IRB approved EMR access in your protocol.

 NMHC is providing medical services such as labs for my research participants. The participants are not necessarily NMHC patients but are registered with the hospital and have an MRN for billing purposes. Do I need to use the EDW to acquire these lab values?

Yes, the policy applies to all clinical data used for research purposes that comes from an NMHC EMR or other clinical system.

 Does this policy apply to my case report forms and other research data that I capture outside of Epic or Cerner?

The policy applies to data residing on an NMHC system, such as Epic or Powerchart. While this policy does not apply to research data captured in systems outside of NMHC, such as investigator-initiated surveys for patient reported outcomes, NMHC data should not be copied from the chart/EMR into third-party systems.

 What do I need to submit to be considered for an exception?

The process starts with an email to nmedw@northwestern.edu. You will answer specific questions about your time frame, funding, sensitive PHI and information about the data you are requesting. You will need an approved data security plan submitted with your IRB submission. Once all of those documents have been collected and reviewed, an exception request will be submitted on your behalf.

 What is the process once I have submitted these documents?

The NMEDW Support Team will review your initial request and send you a form to complete to begin the exception/documentation process. Click here to see an example of the form. Please be as detailed as possible when filling out the form. The more information that we have, the quicker the process will go. If additional study team members also need EHR access, please be sure to fill out the survey question that says "Please list the Northwestern University NetID of other users on this study who require access to the EMR."

The NMEDW Support Team will review your submitted form and submit the request to EDW management for final review. Should EDW management have questions about your request, they will reach out to you via email. EDW management review takes two to three business days. Should your exception/documentation request require further review by the FSMIT Steering Committee, this will take an additional two to three business days.

Once your exception is approved, the Principal Investigator (PI) of your study will need to sign an attestation. Click here to see an example of the attestation form. Please notify your PI to expect the attestation. The attestation will be sent to their email and will come from nmedw@northwestern.edu.

After the exception or documentation is approved and your PI signs the attestation form, additional attestations will be sent out to the other requested study team members. Additional attestation form(s) will be sent to the user(s)  within one business day of the NMEDW Support team receiving the request.

If you are eligible to come through the NMHC Research Access Program (employees of NU, permanent or temporary) you can email accesspr@nm.org to initiate the IT ticket to obtain EMR access. If you have already initiated a request, you can contact accesspr@nm.org to request a status update.

 How does this process change if I have a waiver of consent and a waiver of HIPAA authorization?

The process is the same as described above, but also requires your IRB approval letter stating that you have both a waiver of consent and a waiver of HIPAA authorization.

 How do I know if my data security plan is approved?

You should contact FSMIT-policy@northwestern.edu if you have questions about your data security plan.

Types of Data & Chart Review

 I need data from free text notes (e.g., RN notes, progress notes, radiology reports). How do I get free text data from NMEDW?

NMEDW does contain free text notes that can be provided to you in a report format. You may review the notes in the report to abstract notes, just as you would by accessing the chart in the EMR.

 I need to browse the medical record to abstract information from free text fields. Using the EDW report format would take much longer than simply browsing the user interface of the EMR. Do I still need to use the EDW to be compliant with this policy?

Chart review is permitted as long as no data is copied out of an NMHC system. This means you can verify information you already have, but you cannot write down or transcribe data/information from the medical record, including portions of notes fields in the medical record.

 We need to view the chart for the purpose of patient safety or clinical care. Do I have to use the NMEDW for patient safety or clinical care?

Such activities may only be conducted at covered entities such as NMHC, Lurie Children’s Hospital and Shirley Ryan AbilityLab. Those organizations govern how such activities may be conducted.

 Can I still use an NMHC system (e.g., Epic, Cerner, OTTR) in order to validate or verify data from EDW that was used in publication?

Chart review is permitted as long as no data is copied out of an NMHC system. This means you can verify information you already have, but you cannot write down data/information from the medical record, including MRNs, lab values, demographics such as address or phone number or any other piece of information into a spreadsheet, piece of paper or any other medium for data storage. 

Real-Time Needs

 We have an acute need to identify participants in real time in the clinic. Can I access real-time data in the NMEDW for this purpose?

If the EDW cannot provide you the information you need within 48 hours to make study enrollment decisions, please submit a request for an exception to nmedw@northwestern.edu. In that request, be sure to include the IRB approval number for the protocol, as well as the recruitment strategy, including details for why the EDW is inadequate. Granting of the exemption is not guaranteed and will be reviewed by the FSM IT Steering Committee.

 Medical record screening needs to occur on the day of a consult, which means an EDW report may not provide the most up-to-date info because it refreshes once a day. How would I handle this?

Chart review is permitted as long as no data is copied out of an NMHC system.

Non-EDW Data

 How does the policy apply to data that isn’t in the NMEDW, such as image data?

The NMEDW contains the clinical data from NMHC systems, including image annotations. Images themselves are not in the EDW, and access to images will soon be managed by a consolidated system. Requests for this type of data should still be submitted to the EDW so they may be documented.

 I need to acquire data from PDF files attached to the medical record. Can I access PDFs and scanned documents in the EDW?

No, the EDW does not contain scanned documents. The Health Information Management department at NMHC can assist in obtaining copies of scanned documents.

 I use analytical and self-query tools in an NMHC system such as Syngo to acquire data for research purposes. Will the complex and proprietary query login of this system be re-created in EDW so I can perform the same queries in EDW?

In cases such as these, please send an email to nmedw@northwestern.edu so we may better understand your data needs and recommend the best path forward.

Industry-Sponsored Studies

 Can industry monitoring and quality assurance personnel continue to log in to the EMR during treatment and the follow-up period?

Yes. Chart review is permitted as long as no data is copied out of an NMHC system. This means you can verify information you already have, but you cannot write down facts from the medical record, including MRNs, lab values, demographics such as address or phone number or any other piece of information into a spreadsheet, piece of paper or any other medium for data storage.

 I have a site visit from my study’s sponsor, who must review source documents related to the study. Currently, as required by study sponsors and Good Clinical Practice guidelines, clinical research staff must access the medical record at the time of the visit in order to provide the necessary information.

You can continue to do so, but as with chart reviews, no data is to be copied out of an NMHC system. This means you can verify information you already have, but you cannot write down facts from the medical record, including MRNs, lab values, demographics such as address or phone number or any other piece of information into a spreadsheet, piece of paper or any other medium for data storage.

Back to top

Participating Institutions: