U.S. Department of Health and Human ServicesHHS National Institutes of HealthNIH National Center for Advancing Translational SciencesNCATS
Home

Identify Registry Stakeholders

You can set your registry up for success by identifying stakeholders early in the registry development process. Involving these individuals can help ensure that you have brought together people who possess the necessary skills and expertise to create and manage a registry. Speaking with the different members of your community either online (e.g., through forums, social media, websites) or in person (e.g., through talks, conferences, events) can help you determine the current understanding of your disease. Determine the main objectives of each stakeholder and clearly define the expected contributions for each role.

Registry stakeholders may include the following:

Determine What Research is Being Done

Knowing what research is underway will provide insight into what is known about your disease and the current focus of researchers.

As you search the resources below, try to find out:


Explore these online resources:

Protect Human Research Participants

Informed Consent
What is informed consent?
Informed consent is a process for making sure that patients and caregivers who give information to a registry understand how that information will be used. Registry participants sign a form stating they understand the reason for participating in your registry. By signing the form, participants show that they agree to voluntarily share their personal and rare disease information.

You are responsible for informing participants about the information you intend to collect and how the information will be used. You also need to explain who will have access to the information and how the registry might affect participants. You must answer registry participants’ questions and give them regular updates about the registry after they’ve signed the informed consent form.

How does informed consent apply to registries?
If you plan to share participant information from your registry with researchers who are developing treatments for rare diseases, you must get participants’ informed consent. Without informed consent from registry participants and their legal guardian, you can’t give patient data to researchers.

Institutional Review Board (IRB)
What is an IRB?
An IRB is responsible for protecting the rights and welfare of people who participate in research studies. An IRB is a group of people with diverse backgrounds, such as healthcare professionals, patient advocates, and non-science professionals.

The IRB will review studies, including clinical trials that use registries, before the studies begin recruiting participants. Based on its review, the IRB either approves or does not approve each study.

The IRB can require changes to the study plans. These changes typically ensure that risks to participants are limited and the study collects informed consent. The IRB might also require changes to protect participants’ privacy and make sure that the study follows all relevant laws and rules. The IRB also has the authority to monitor the research once it starts.

How does the IRB apply to registries?
If you plan to share participant information from your registry with researchers, an IRB must first review the clinical trial that your participants are being asked to join.

The Federal Policy for the Protection of Human Subjects (‘Common Rule’)
What is Common Rule?
The Common Rule is a federal policy that protects personally identifiable information of participants in federally funded research studies. Personally identifiable information is information that could be used to identify the participant.

How does the Common Rule apply to registries?
If a researcher invites your registry members to participate in a federally funded study, the researcher has to follow the Common Rule.

 

Be Informed of International Laws

General Data Protection Regulation (GDPR)
What is the GDPR?
The GDPR is a regulation that sets guidelines for collecting and processing personal information from individuals who live in the European Union (EU) and the European Economic Area. The 27 member countries  of the EU share a set of economic and political policies. Three other countries (Iceland, Liechtenstein, and Norway) are part of the European Economic Area, which allows these countries to be part of the single EU market.

The GDPR also regulates the release of personal information outside the EU and European Economic Area. The GDPR simplifies regulations that give individuals control over their personal information regardless of where in the world that information is used.

How does the GDPR apply to registries?
If your registry includes participants from the EU or European Economic Area, it must comply with the GDPR. These regulations apply to the personally identifiable information of people in the registry, regardless of the location of the registry.

Overview

As soon as you decide to create a registry, become familiar with the ethical and legal responsibilities of running a registry. If you don’t follow the laws and rules from the beginning of your registry, your registry might not be usable for research or, ultimately, the treatment-approval process.

Make sure that your registry follows local, state, and federal laws and rules that cover the collection of personal and health information. In some cases, you need to follow international laws and rules as well. Which rules and regulations your registry needs to follow depends on the type of information the registry collects, how the registry will be used, and who gives and uses the information.

It might be a good idea to talk to a lawyer or ethics expert. These experts can help make sure that your registry follows the relevant laws and rules.

Know U.S. Laws & Regulations

The Health Insurance Portability and Accountability Act (HIPAA)
HIPAA prevents improper sharing of sensitive patient information (also known as protected health information [PHI]). Any health information that can be used to identify a person is PHI. Examples of PHI include 18 identifiers (e.g., name, address, birth date, and Social Security number). A full list of PHI types is available on the National Institutes of Health website.

HIPAA protects patient privacy and protects patient data from theft and fraud. Personally identifiable information is data that other people could use to figure out who a participant is. Patients who want to share their health data with health care professionals must give permission to release their PHI.

This table compares the HIPAA rules that protect the privacy and security of PHI.

Patient Privacy
 Data Security
What is it? Protects the use of patient
information and puts policies
in place to ensure that patient information is being collected,
shared, and used in
appropriate ways.		 Focuses on protecting
patient information from malicious computer attacks and the stealing of patient information for profit.
Rule HIPAA Privacy Rule HIPAA Security Rule
How can I apply the rule? Your registry can:
  • De-identify patient information.
  • Use patient information for purposes only mentioned in the informed consent.
  • Share patient information only with those mentioned in the informed consent.
 Your registry can:
  • Convert the data into special codes
    that hide the information from people who don’t have permission to see the data.
  • Control who has access to the data.
  • Give people with different needs access to different types of information (such as more-detailed or less-detailed information).

How does HIPAA apply to registries?
If you plan to share PHI from your registry with researchers, you need to follow HIPAA. HIPAA can help you protect the information in your registry from hackers and other people who could change or use the data without your permission or the permission of your registry participants.


Food and Drug Administration (FDA) Regulations
What are the FDA regulations?
FDA rules protect people who participate in research studies that FDA regulates. FDA rules protect research participants’ privacy and the confidentiality of their information used in research.

FDA publishes its rules in Title 21 of the Code of Federal Regulations (CFR) (also known as 21 CFR). The Federal Register is the official daily publication of U.S. government rules, proposed rules, and notices. The federal government updates the CFR once a year.

How do FDA regulation apply to registries?
If the participant information collected in your rare disease patient registry will be used in research involving an FDA-regulated food or drug, and if it requires an informed consent, you must follow the regulations outlined in 21 CFR. If your registry’s participant information will be used in a U.S. Department of Health and Human Services (HHS) study, the regulations in 21 CFR part 50   and 45 CFR part 46 must be followed. Where the regulations differ, those that offer the greater protection to participants should be followed.

Federal Information Security Management Act (FISMA)
What is FISMA?
FISMA protects the unauthorized use of electronic and paper information that contains federal data. This also applies to information associated with National Institutes of Health grants and contracts. FISMA prevents people who don’t have permission from having access to protected information in data systems, such as registries, that have funding from the federal government.

How does it apply to registries?
The law covers registries that collect, store, use, or send patient data on behalf of a federal agency. The law also covers registries that have money through a federal grant or contract.

 

 

Be a Good Data Steward

When you decide to collect data, you take on the role of being a data steward. You need to protect the rights and interests of the people who have provided the information. You build trust by being purposeful, open, and transparent.

Be purposeful

Be open

Be transparent

Data stewardship applies to everyone interacting with the registry’s data. Some registries have a designated person responsible for proper data management, whereas others have an entire team dedicated to this role. Regardless of the number of people assigned to this role, the registry should have a governance plan that provides guidance for making decisions about how the registry will be managed and how and with whom the data will be shared. It is the responsibility of these individuals to ensure the data are used appropriately and kept safe and secure. One way to ensure this protection is to enter in data-use agreements with the researchers or other individuals who want to access your registry’s data. Data-use agreements clearly state the permitted uses of the participants’ information and protects the privacy of the registry participants.

Understand What is Data

Data can be defined as a collection of information. Data usually include quantitative and qualitative information. Quantitative data include measurable information, such as height and weight. Qualitative data is descriptive information, such as sex and ethnicity. The goals of registry determine what kinds of data are collected. Registries typically collect both quantitative and qualitative.

Determining what kinds of data and how much of it needs to be collected requires thoughtful consideration. Because little is known about many rare diseases, you may be tempted to collect as much information as you can. But it’s important that you do not overwhelm the people providing the information to your registry. You must take care to balance what you need to know (essential data) with what you would like to know (nonessential data). It is especially important that the information you collect is of high quality. Low-quality data cannot be used for research. High-quality data are verifiable, accurate, and are an exact fit for the registry’s intended use. The data you collect must be capable of delivering the insight you hope to gain.

Data quality is determined by the following:

  1. Accessibility – Are the data available? Are the data easily and quickly obtained?
  2. Completeness – Is the data complete? Are the necessary questions included on your registry data collection forms? Were all the questions answered?
  3. Accuracy – Are the data correct and reliable?
  4. Objectivity – Are the data free of bias?
  5. Relevancy – Do the data address the questions your registry is attempting to answer?

Make sure you collect only high-quality data for your registry by following the FAIR Guiding Principles for scientific data management :

Findability – Data should be easily found.
Accessibility – Once the data is found, it should be accessible.
Interoperability – Data needs to be integrated with other data and to be able to work with various different applications.
Reusable – Data should be able to be re-used for different research and/or purposes.

We created the RaDaR Tool: Data Quality Control Checklist to assist you in evaluating the quality of data.

Learn About Data Ownership

Before joining a registry, people may want to know who will own the data they share. Data ownership refers to having legal rights and complete control over the data. Ownership of this information should be clearly communicated to participants, stakeholders, and sponsors of the registry. In many cases, the sponsors are the owners of the data. When there is more than one sponsor, it is important to determine which sponsors own the data. Your registry should also decide who will own any intellectual property resulting from the registry (e.g., tools, forms, reports, analyses, and biosamples). Participants will need to trust that your registry is acting in their best interest.

Data owners need to remember the FAIR principles when determining how they plan to handle the sharing of their registry’s data. They should also appreciate that data sharing is critical for learning more about their rare disease and advancing research. In an effort to facilitate data sharing, they should create a data management plan and data-sharing agreement. Some considerations include the following:

Overview

It is critical to fully understand what data are, and the best practices and guiding principles that a registry should follow when collecting, maintaining, and sharing data. Having entrusted you with information about themselves and their rare disease, registry participants expect you to act in their best interest with respect to being transparent and open. Researchers need to have confidence in the quality of your registry’s data.