 Welcome everybody. It is 205 and I'd like to welcome you to breakout session number 18. It is entitled copyright privacy and institutional protectionism for clinical setting based theses and dissertations. And your presenters today are Rhonda Marker from Rutgers University Library, Tracy Vitao from Rutgers University School of Nursing, and Peggy Drucker from Seton Hall University School of Medicine Library. If everyone could just make sure to leave your audio and video off. And if you have any questions, go ahead and put them in the Q&A field and we'll address them at the end of the presentation. And so now I'd like to turn it over to our three presenters. Welcome. Thank you so much. Thank you for having us, Terri, and for moderating this session. And for introducing our presentation, copyright privacy and institutional protectionism for clinical setting based theses and dissertations. Again, please post any questions that you might have in the question and answer section. Next slide. So one of the things I'd like to highlight about our team is it really is an interdisciplinary group of us working across several different universities and settings. I, as Terri mentioned, am part of the School of Nursing at Rutgers Biomedical and Health Sciences in Newark. And I am the specialty director for the Doctorate of Nursing Practice Projects. Peggy Drucker is the Health Sciences Librarian at Hackensack School of Medicine at Seton Hall University. And Rhonda Marker is the Interim Associate University Librarian at Rutgers. And Molly Bradshaw, who was unable to make it today due to an emergency, is the DNP coordinator and associate professor at Eastern Kentucky University. Over 8,000 students graduate annually with a Doctorate of Nursing Practice degree. With each required to complete a practice change project, we recognize the importance of that these projects having vast reach on the importance of issues such as copyright and privacy, particularly because of the setting of these projects taking place in a clinical setting. Additionally, we also want to recognize consideration of other disciplines that might also have similar expectations, including but not limited to physical therapy programs, occupational therapy programs, and other such practice-based degrees. Next slide. So for those of you that are unfamiliar with what a DNP project is, it's a final academic product where students have an opportunity to integrate new skills into practice. It allows them to demonstrate the core essentials of doctoral education for nursing practice. And they're different from the traditional dissertation or thesis or capstone that students finish depending on their degree level. And the page length can vary and the formatting can vary greatly in terms of what is entailed in part of a DNP project. The purpose of these projects are to improve outcomes through organizational or systems leadership, quality improvement processes, as well as the transmission of existing evidence into practice. So that being said, there are several different types of DNP projects that we might see being submitted to repositories. They may include quality improvement projects, program evaluations with formal organizational recommendations, the implementation and evaluation of evidence-based practice guidelines. The project may be a policy analysis, whether locally or national policy. There might be the design and use of databases to analyze information for decision-making, planning and evaluation on an organizational level. It may be a financial analysis of care models and potential cost savings, community action projects, development of clinical practice guidelines, the integration of technology into patient care, or a systematic review with a knowledge transfer piece. And also I want to focus on the dissemination of the final project is expected to take place at a variety of levels. Initially, the local university requirements, which often include a paper, a poster and a presentation, but also to the broader audience such as the project site and beyond at local, regional or national conferences. And these are often submitted in the form of executive summaries or written reports. Next slide. So very quickly, when we think about what the project must include, regardless of the type of project, all projects must focus on a change that impacts healthcare outcomes, either directly or indirectly, have a systems or population focus. There needs to be some type of direct implementation of the project, as well as including a plan for sustainability. The project must have some type of evaluation of outcomes and processes, and considering both statistical significance as well as clinical significance. And it is the expectation that these projects provide a foundation for future practice scholarship of the students. Next slide. So one of the issues that comes up in the context of a DMP final project is that of who holds the copyright in the work. It's not common, but sometimes there are co-authors for a DMP project, and copyright for these works is the same as with any other co-authored work. Both authors hold the copyright. I think this audience knows all of this. Often the faculty advisors are quite actively involved in the students' research, and they guide the student in writing up the proposal for the final project. We do have to make sure that the faculty advisor knows that it doesn't follow that they hold copyright in the work that results from the research. We have to emphasize that the DMP final project is a separate academic product, and in most cases it is regarded as the student's work. But the academic institution ideally has a copyright policy that clearly states the institution's position with regard to student work, whether it is a class paper, a master's thesis, or a DMP final project. And that can be very helpful in this instance. Next slide. So when it comes to the DMP final project, because of the kind of research that is based on, which is usually in some sort of institutional setting, a clinical setting, a healthcare provider setting, and so forth. We have to work hard to make clear that the institution in which the research is set cannot claim to hold copyright in the student's academic product. The fact of the matter is most people, including really smart administrators in healthcare institutions, have not had the opportunity to learn very much about even basic copyright law. So we want to make sure that everyone involved in supporting the student research has a common understanding of what can be copyrighted and who holds copyright. There are ways in which stakeholders can come to a shared understanding, such as an agreement among the student researcher, the advisors, and the partner institutions. Sometimes these agreements could be a verbal understanding, but we would rather see a written document such as an MOU, a data use agreement, or a reliance agreement between the student and the institution. There's also sometimes confusion about the difference between work for hire product, and that should be distinguished from the DMP final project, even if the student might simultaneously be employed by the institution in which the research is set. While it might benefit the healthcare institution, the work the student produces is a degree requirement and an academic product. So having a discussion among all the stakeholders at the time of the project proposal gives everyone a chance to raise concern before time and resources are invested. Next slide. So the American College of Nursing gives a large amount of latitude to define what a DMP project actually is. Therefore, the type of research being done for a DMP project really varies. Some projects may or may not constitute human subject research or require access to protected health information. One thing that binds all of the types of DMP projects together are that there are federal regulations which must be followed before the research process can begin. It also follows that strict adherence to these rules must be documented before a DMP project can be deposited in a repository for global dissemination. Regardless of the type of DMP project, all students must be granted a determination related to the protection of human subjects and of healthcare information. When a project involves accessing PHI protected health information, students need to comply with privacy and confidentiality requirements and obtain permission from the appropriate IRB or Privacy Board. If a project is deemed human subject research, then IRB approval is definitely needed. If the DMP project is not deemed HSR, but the students will still access protected health information, permission must be obtained through the IRB or through the Privacy Board. As a practical matter, all research conducted by an academic medical center in the United States must comply with the common law. Research involving the use of PHI must adhere to both HIPAA privacy rules and the Department of Health and Human Services common rules, which are both accessed under the Code of Federal Regulations. Some institutions have an independent privacy board, while others delegate HIPAA implementation to the IRB, the Institutional Review Board. The IRB, using HIPAA as a guide, oversees the research or the use or disclosure of protected health information. Both HIPAA regulations and IRB regulations under the common rule allow researchers to use PHI in preparation for research. The process of using patient medical records for patient data for research in a DMP project is not an issue when the patient can provide informed consent. The consent is distinct from consent to treat. The difficulty arises when DMP students wish to access patient files without being able to obtain first informed consent. In many cases, obtaining informed consent from the patient is simply not possible. It's not practical or it's not cost effective. In many instances, insisting on patient consent might mean the DMP project could not even be done. Important research would not be conducted if there was not an alternative to informed consent. How you would actually go about doing that is by de-identifying certain parts of the patient information, which could then make the data usable. The Health Insurance Portability and Accountability Act, HIPAA, sets forth the policies to protect patient health information. There were actually 18 HIPAA identifiers that are taken under consideration. If a certain patient record or a patient file has some of these de-identifiers moved, it's no longer considered to be protected health information and is no longer under the restrictions as defined by HIPAA. So an important consideration is depending on the type of data the DMP student is collecting and the form of IRB approval that's necessary. Students may be required to obtain a data use agreement form signed by legal representatives of both the university and the institution in order for a final IRB approval to be issued. A data use agreement establishes who is permitted to use and receive the final data sets and the permitted uses and disclosure of such information by the student and provides that they will, among other guidelines, not use or disclose information other than what is permitted by the data use agreement or required by law. This is really a safeguard that protects both the individual and the institution that the student is doing their projects in. So how's the best way to protect patient privacy actually in research? Before archiving a DMP project into the repository, close attention is really needed to ensure that the DMP project is in compliance with regulatory issues such as HIPAA. For submission into a repository, a DMP project should have IRB approval, a HIPAA waiver if needed, a workplace or study site permission to publish their DMP project in the repository, the data use agreement. If the DMP project involves human subject research, the student needs to have some written documentation from the IRB outlining the IRB approval of the project. If the project involved has PHI protected health information that the research is governed by HIPAA, all DMP projects must be in full compliance with HIPAA regulations. Students with projects that do access protected health information need to document a copy of their IRB HIPAA waiver and written permission from the institution privacy officers in order to use this data. So one of the main issues in that when a DMP student actually does their work, they're forming a partnership, a research partner with another institution. And it would be where that student is going to perform their research. It could be a hospital, it could be a private physician's office, a private practice, a clinical setting. And by no means does the home institution of the student want to endanger the clinical relationship that they've built. So it's really important to establish clinical relationships that everybody understands the scope of the research ahead of time. A workplace permission form or an MOU, a Memorandum of Understanding, is suggested that the students know exactly what their final project is. It's going to be reviewed by the appropriate authorities at their workplace. And often they have to obtain the signed workplace permission form even before the projects begin. Students may only be able to get this workplace permission form after they agree to de-identify certain bits of information for data collection. Because of this, it's become standard practice to advise students to de-identify their workplace institution throughout the final DMP project from the beginning of the project. So it's not delayed being accepted into a repository. Okay. So just to summarize, this is what we conclude. DMP students and everyone involved in this project should have a shared understanding of copyright basics and who holds copyright in the final project. DMP students should view HIPAA regulations and the IRB as tools that actually provide a path for the student to conduct their research. Students should have assigned MOU with the study site before they begin their DMP project. And a university repository is the best tool to share the knowledge that they gain. So we would like to invite you to, we have a question. Okay. My institution has a DMP program. I am unfamiliar with MOU. Could you elaborate? Well, we are talking about a memorandum of understanding. And these could take various forms. Usually it just lays out all of the things that are known about the project, what kind of methodology will be used, what kind of data will be accessed, how that data will be used. And basically it just lays out how the research will be done so that not only will the student be clear about what they are doing, but also the university as well as the research setting institution that came out awkwardly, knows ahead of time what the student intends to do. What we are trying to do is to avoid any last minute surprises, which usually are at best awkward and at most could really derail being able to share the resulting academic work. This is important because students will often spend the better part of an entire semester at least developing what that proposal is and what they want to do for their project. And they can have a fantastic project and excellent sound methodology. However, if when it comes to getting approvals, whether it be through the IRB or approval through the legal department, if it's not something that it's not data that the organization is willing to share or want to be made publicly available, we want to know that ahead of time rather than the student spending 16 weeks plus working on a proposal only to find out that they're going to have to start from scratch because what they wanted to do was not going to be acceptable to the organization. I don't see any other questions at this time, but certainly we still have plenty of time in this session. So, you know, feel free to, you know, put another question in. And Allison's asked a follow up question our MOU submitted to the IR with fight with the final approved DMP project. So usually what happens is, it depends on the type of IRB review that's necessary. If it is deemed expedited or requiring a full review, which is usually not the case in terms of full reviews are not usually the type of review that DMP projects require. But if it is if there's going to be any identifiable information, even if it's going to be eventually de identified, they do want to see that memorandum of understanding and or the data use agreement prior to issuing a final IRB approval. So they're usually done in parallel with each other. The IRB may review it and say, yes, it's approved with stipulations. We will issue you a final approval once we have a fully executed data use agreement or reliance agreement. Tracy, are those documents actually included in the final submission to the repository or held back usually they're held back. Okay. I know I'm the moderator here. But I'm looking at our at our program and it looks like there was a typo with the times what was your understanding presenters of how long you had 25 minutes. Okay, that's okay. So we actually are over time. And I have to, well, we all are going to be going to other sessions. So thank you so much for all of your great information. And as always, you know, these are recorded and they will be available for later viewing. So thank you again everyone for attending and to our presenters for sharing their experience and information. Thank you so much. Thank you very much too. Welcome.