Frequently Asked Questions (FAQs)

Before receiving iPHD data, all approved applicants must provide the following:  

1. Data Use Agreement (DUA), which outlines the terms and conditions for ensuring data security and privacy. As part of the DUA, a Data Management Plan must also be submitted to ensure proper handling and storage of the data;   

2. Proof of Institutional Review Board (IRB) approval from their home institution, ensuring that their research complies with ethical and regulatory standards. The Institutional Review Board must be organized under the Federal Human Subject Research protection regulations (45 CFR Part 46) and hold a Federalwide Assurance with the Office of Human Subject Research Protection;  and 

3. Payment of data fees (if applicable).

For applicants awarded a fee waiver, the DUA and the IRB must be completed within six (6) months of notification of approval. A one-time 30-day extension may be requested in writing if additional time is needed.

Visit the iPHD Data page for more information including currently available data, date ranges and data dictionaries. Additional data sets will be made available in the future and the website will be updated accordingly.

iPHD provides linked datasets with a unique study ID that allows researchers to track individuals across different data sources without reidentification.  Investigators are responsible for defining and creating their cohorts using the linked data we provide.

Data files are structured by data source and year. Files are delivered as SAS data files.

The iPHD will provide de-identified data where feasible or a HIPAA-compliant limited data set (LDS) to researchers approved to receive data from the iPHD.

De-identified data: Section 164.514(b) of the HIPAA Privacy Rule provides the standard for de-identification of protected health information. Under this standard, health information is not individually identifiable if it does not identify an individual and if the covered entity has no reasonable basis to believe it can be used to identify an individual. De-identified datasets using the “Safe Harbor Method” exclude 18 specific identifiers of individuals or of their relatives, employers, or household members of the individual, as listed below:   

1) Names 

2) All geographic subdivisions smaller than a state, including street address, city, county, precinct, ZIP code, and their equivalent geocodes except for the initial three digits of the ZIP code 

3) All elements of dates (except year) for dates that are directly related to an individual, including birth date, admission date, discharge date, death date, and all ages over 89 and all elements of dates (including year) indicative of such age, except that such ages and elements may be aggregated into a single category of age 90 or older 

4) Telephone numbers 

5) Vehicle identifiers and serial numbers, including license plate numbers 

6) Fax numbers 

7) Device identifiers and serial numbers 

8) Email addresses 

9) Web Universal Resource Locators (URLs) 

10) Social security numbers 

11) Internet Protocol (IP) addresses 

12) Medical record numbers 

13) Biometric identifiers, including finger and voice prints 

14) Health plan beneficiary numbers 

15) Full-face photographs and any comparable images 

16) Account numbers 

17) Any other unique identifying number, characteristic, or code, except as permitted by the Privacy Rule for re-identification; and 

18) Certificate/license numbers 

Limited data set (LDS): Pursuant to 45 C.F.R. § 164.514(e) (2), an LDS excludes most of the identifiers described above but may include one or more of the following: 

• Dates such as admission, discharge, service, date of birth, date of death; 
• Municipality, state, zip code; and 
• Ages in years, months or days or hours 

Limited data sets released by the iPHD will include only the minimum necessary information needed to complete the approved research project and use of the LDS will be governed by a Data Use Agreement.   

Please see the Department of Health and Human Services, Health Privacy Information website or the HIPAA legislation for additional information.

No, the iPHD team provides data based on the requested data sources and years in your application. It is the responsibility of the investigator to subset the data to create specific cohorts.

Researchers may only request data years that are available at the time of the application cycle, as listed on the iPHD website and application materials.

However, if additional data years become available after application submission but prior to initiation of the IRB and Data Use Agreement (DUA), researchers may choose to either: 

• Retain their original data request; or 
• Request the newly available data year(s), subject to additional data fees as outlined in the iPHD fee schedule. 

iPHD staff will notify researchers of any newly available data years at the time of application approval and ask them to confirm their final data years. This selection is considered final. All required agreements, including the DUA and IRB, must align with the confirmed data years. Researchers may not delay data transfer in anticipation of future data availability. 

If researchers wish to obtain additional data years after their final selection, they must submit a written request to the Governing Board for review and approval. If approved, the researcher will be responsible for: 

• Paying any applicable data fees per the current fee schedule; and 
• Paying an additional processing fee if staff time is required to prepare an updated dataset and related updated compliance agreements (billed at an hourly rate). 

This option may only be used once per project. 

Please note: This policy applies only to requests for additional data years. If a researcher wishes to request a different dataset than originally submitted, a new application is required and will be subject to standard iPHD review procedures. 

Linkages between iPHD data and other datasets are evaluated for technical feasibility and HIPAA-compliance to ensure linkages do not enable the re-identification of individuals.  Additional fees may apply for linking external data. For those receiving a fee waiver, please note that these additional linkage fees may not be covered.

Researchers may only request data years that are available at the time of the application cycle, as listed on the iPHD website and application materials. ​

However, if additional data years become available after application submission but prior to initiation of the IRB and Data Use Agreement (DUA), researchers may choose to either: ​

• Retain their original data request; or ​
• Request the newly available data year(s), subject to additional data fees as outlined in the iPHD fee schedule. ​

iPHD staff will notify researchers of any newly available data years at the time of application approval and ask them to confirm their final data years. This selection is considered final. All required agreements, including the DUA and IRB, must align with the years requested. Researchers may not delay data transfer in anticipation of future data availability. ​

If researchers wish to obtain additional data years after their final selection, they must submit a written request to the Governing Board for review and approval. If approved, the researcher will be responsible for: ​

• Paying any applicable data fees per the current fee schedule; and ​
• Paying an additional processing fee if staff time is required to prepare an updated dataset and related compliance agreements (billed at an hourly rate). 

This option may only be used once per project. 

Please note: This policy applies only to requests for additional data years. If a researcher wishes to request a different dataset than originally submitted, a new application is required and will be subject to standard iPHD review procedures.