Correspondence between

Robert, Here are ivy comments regarding this DUA. Please feel free ta give me a call f you have any questions. Asi indicate below, we also need to see about whether our IRE needs to be imrabred. 1. Twant to know more about the study that is being recreated in item 1. The attached protocol seems te discuss more about the study of the water samples, not the blood lead data, Saying that the researcher wants to verify the claim of MDEQ is not sufficient. It does not have to be a great deal longer, but it should explain what the intended use of the blood lead data is. It is also important to know exactly how it will be used for research in order to justify the release not just under HIPAA, but also under R 325.9086 pertaining to the confidentiality of blood lead test reports. It must be for the “If necessary for the purpose of research designed to develop or contribute to generalizable knowledge, with documented approval by the department's institutional review board.” R 325,9086(2\e). | am not sure how lan would handle this, given the language in the rule that seems to require IRB approval. Ww Tying in with L. above, telling us that the analysis will be similar to some other study is insufficient. This section should tell us how the data will be used and disclosed, how many people (research team) might have access, what formats it might be used in and other similar information, The attached research protocol, as noted above, does not get into sufficient detail regarding exactly how our blood lead data will be used and how its use will be restricted, Lalso need to know more about how the data will be secured on their end, how it will be handled, by: who, and what will be done with if when it is no longer needed for their study. 3. The researcher indicates this data will be deidentified, but then goes on to ask for a number of identifiers that make the data identifiable, inchuling county, city, and birth date of the child. In order for data to be deidentified (short of the statistical analysis method which would have to be dacumented and shawn to us), it must not contain any geographic subdivision smaller than state. 45 CFR 164.414(by2)(4)(B). 2 xxxEND_PAGE:dhhs01_b85_257_331_58 000315 Additionally, all elements of dates related to the individual must not be included, which includes birth date. 45 CFR 164.414(b)Q2)()(C). Therefore, the researcher must follow protocels for identifiable data, which may include requesting a waiver of informed consent from the IRB. The researcher could possibly obtain the date requested as a limited data set without a waiver | believe (though we stil would want to run it by the IRB). If this is the case, item 3.b. should be changed to “Limited Data Set.” Golin Boes, JD Privacy Specialist Office of Legal Affairs & FOIA Michigan Department of Health & Human Services 201 Townsend St Lansing, Michigan 48933 (S17) 338-8558 ~ T (847) 241-1200 - F

Rohert, Here are my comments regarding this DUA. Please feel free to give me a call if you have any questions. As! indicate below, we also need to see about whether our 88 needs to be involved. 1. I want to know more about the study that is being recreated in item 1. The attached protocol seems to discuss more about the study of the water samples, not the blood lead data. Saying that the researcher wants to verify the claim of MDEQ is not sufficient. [t docs not have to be a great deal longer, but it should explain what the intended use of the blood lead data is. It is also important to know exactly how itwill be used for research in order to justify the release not just under HIPAA, but also under R 325.9086 pertaining to the confidentiality of blood lead test reports, It must be for the “If necessary for the purpose of research designed to develop or contribute to generalizable knowledge, with documented approval by the department’s institutional review board.” R 325,9086(2\e}. 1 am not sare how lan would handle this, given the language in the rule that seems.to require IRB approval. 2. ‘Tying in with 1. above, telling us that the analysis will be similar to some other study is insufficient. ‘This section should tell us how the data will be used and disclosed, how many people (research team) might have access, what formats it might be used in and other similar information. The attached research protocol, as noted above, does not pet into sufficient detail regarding exactly how our blood lead data will be used and how its use will be restricted. xxxEND_PAGE:dhhs01_b85_257_331_43 000300 Lalso need to know more about how the data will be secured on their end, how it will be handled, by who, and what will be done with it when if is no longer needed for their study. 3. The researcher indicates this data will be deidentified, but then goes on to ask for a number of identifiers that make the data identifiable, including county, city, and birth date of the child. In order for data to be deidentified (short of the statistical analysis methad which would have to be documented and shown to us), it must not contain any geographic subdivision smaller than state. 45 CFR 164.414(b)2 7B). Additionally, all elements of dates related to the individual must not be included, which includes birth date. 45 CPR 164.41 4(b)(2)G\(C). Therefore, the researcher must follow protocols for identifiable data, which may include requesting a waiver of informed consent from the IRB. The researcher could possibly obtain the data requested as a limited data set without a waiver | believe (though we sull would want te run Rt by the IRB). if this is the case, itern 3.b. should be changed to “Limited Data Set.” Colin Boes, JD Privacy Specialist Office of Legal Affairs & FOIA Michigan Deparment of Health & Human Services 201 Townsend St. Lansing, Michigan 48933 (517) 935-8568 — T (S17) 244-1200 - F

Robert, thank you for letting me know about the time-sensitivity. Iwill do my best to get this turned around as soon as | can, Since this involves research you may wish to send it the (RB as well and let them know about the urgency. How soon do you think they were hoping to get H back? A few weeks? Shorter? fask because aur [RS director fan is out of the office unui at least next week () cannot remember exactly haw long he is out}. Colin Bowes, JD Privacy Specialist Office of Legal Affairs & FOIA Michigan Departrnent of Health & Human Services 4201 Townsend St. Lansing, Michigan 48833 (B17) 338-8558 ~ T (847) 241-1200 ~ F

Robert, thank you for letting me know about the time-sensitivity. i will doa my best to get this turned around as sean as! can. Since this iwvolves research you may wish to send it the (8B as well and let them know about the urgency. How soon do you think they were hoping to get it back? A few weeks? Shorter? | ask because our [RB director lan is out of the affice until at least next week {1 cannot remember exactly how long he fs out). Colin Boes, JD Privacy Specialist Office of Legal Affairs & FOIA Michigan Department of Health & Human Services 201 Townsend St. Lansing, Michigan 48933 {817} 338-8658 ~ T (547) 244-1200 - F i xxxEND_PAGE:dhhs01_b85_257_331_44 000301