Why this matters
Clinical research data can directly or indirectly identify participants. When exports leave your primary system (EDC, CTMS, lab portal), you lose a layer of control. A well‑run export process lets teams analyze data quickly without exposing identifiers or creating audit gaps. You will be tested—and audited—on whether you applied the minimum necessary rule, protected PHI/PII, and kept a defensible trail of who received what and why.
Core concepts & definitions
PHI/PII (Protected/Personal Identifiers) Any data that can identify a person directly (e.g., name, MRN, SSN, email, phone) or indirectly when combined (e.g., full dates tied to events, free‑text notes that mention names).
Minimum necessary Share only the columns, rows, timeframe, and detail needed for the stated purpose—nothing more.
Role‑based extract A pre‑approved export template aligned to a recipient’s role (e.g., statistician, site, vendor) and task (e.g., analysis, reconciliation, troubleshooting).
Pseudonymization & masking Replace identifiers with study IDs or tokens. Keep any mapping table separate, access‑restricted, and time‑limited. Use date shifting or binning where allowed.
Export register (delivery log) A central record of every extract: requestor, purpose, fields, approvals, delivery method, recipient, checksums, and retention/expiry.
Data classification Label datasets (e.g., Public, Internal, Restricted, PHI/PII) to trigger the right controls automatically.
The process, step‑by‑step
Intake & purpose
- Capture who is asking, what they need, why they need it, where it will be stored/processed, and for how long.
- Confirm the governing agreement (e.g., DUA, vendor contract, protocol, IRB approval).
Scope to minimum necessary
- Columns: Prefer study IDs; exclude MRN/SSN by default. Remove direct contact info unless explicitly needed.
- Rows: Filter to relevant sites, visits, subjects, or time windows.
- Granularity: Use relative dates (e.g., study day) or month‑level bins; avoid exact timestamps unless required.
- Free text: Redact or run a PHI scrub if free‑text fields are included.
Apply privacy controls
- Template or view: Use a role‑based export view with predefined field rules.
- Masking: Tokenize identifiers; keep mapping in a separate, access‑controlled location.
- Date handling: Shift dates consistently per subject or present as offsets, when permissible.
- Suppression: Hide small cell counts (e.g., rare events at a single site) if risk of re‑identification exists.
- Packaging: Use verified encryption (e.g., AES‑encrypted archive, SFTP/secure workspace). Avoid email attachments.
Quality & compliance checks
- Validate structure (columns, types, code lists).
- Run PHI red‑flag checks: did any MRN/SSN, names, emails, full addresses, or exact DOBs slip in?
- Document version, code location (script path or report ID), and dataset checksum.
Approval & logging
- Obtain the required approvals (e.g., study lead, privacy/compliance, vendor manager).
- Record the dataset spec, DUA/contract, approvers, delivery method, recipients, and expiry date in the export register.
Delivery & confirmation
- Deliver via secure channel (SFTP, approved portal, temporary secure workspace).
- Capture delivery proof (transfer logs or portal receipt). Share the checksum with the recipient.
Closure & lifecycle
- Reconfirm retention policy with the recipient.
- Schedule audits for stale copies. Close the request with a link to the register entry.
What good looks like
- Standard templates per role/purpose (e.g., “Biostats Analysis”, “Safety Reconciliation”, “Vendor Support Minimal”).
- Identifiers masked by default; MRN/SSN and exact contact details require explicit approval and logged justification.
- Automated checks flag restricted fields and free‑text for PHI before export completes.
- Single export register with search and dashboards (who/what/when/why/how).
- Secure delivery by design (no email attachments; short‑lived workspaces; encryption and checksums).
- Routine reviews to retire obsolete extracts and update templates when standards change.
Worked examples
Example 1 — Biostatistician (interim analysis)
Purpose: Fit time‑to‑event models; summarize adverse events. Minimum necessary: Subject ID, treatment arm, event indicator, relative day from randomization, AE terms (coded), severity/relatedness, censoring date as study day. Controls:
- No MRN/SSN, names, emails, phone numbers, street addresses.
- Replace all calendar dates with study‑day offsets.
- Remove free‑text AE narratives; provide coded terms only. Delivery: SFTP to stats server; checksum recorded. Register notes: Request RQ‑2025‑041, approver: Lead CDM; expiry 90 days post‑analysis.
Example 2 — Vendor troubleshooting (EDC data load failure)
Purpose: Diagnose a parsing error on visit forms. Minimum necessary: 10 example records with field names/types, Subject ID, site code, error messages; no demographic identifiers. Controls:
- Short‑lived secure workspace (7‑day access).
- Tokenize Subject ID; no mapping provided to vendor.
- Redact comments/free‑text. Delivery: Access granted via vendor portal with MFA; auto‑revoked after closure. Register notes: RQ‑2025‑052; rationale: critical defect; mapping retained internally only.
Example 3 — Safety reconciliation (sponsor ↔ pharmacovigilance)
Purpose: Match EDC AEs to safety system cases. Minimum necessary: Subject ID, site, event verbatim (if required), coded term, start/stop month-year (no day), seriousness, outcome, case ID tokens. Controls:
- Where verbatim text is needed, run PHI scrub; exclude names or contact details if present in text.
- If DOB drives age, provide age at screening (integer) rather than full DOB. Delivery: SFTP; both sides keep matching logs. Register notes: RQ‑2025‑067; cross‑ref to Safety SOP and reconciliation plan.
Example 4 — DSMB/IDMC meeting package
Purpose: Independent safety/efficacy oversight. Minimum necessary: Subject‑level listings with offset dates, treatment arm, endpoints; site identifiers generalized to region if small cell counts. Controls:
- Pseudonymized IDs; no direct identifiers.
- Suppress any site with <5 subjects in sensitive tables. Delivery: Read‑only portal, watermark, and access expiry post‑meeting. Register notes: RQ‑2025‑074; dataset version locked; minutes reference stored.
Pitfalls & misconceptions
- “Internal use” ≠ free pass. Internal teams still follow minimum‑necessary and logging.
- Hidden columns/sheets in spreadsheets. Recipients can unhide them—export only what’s required.
- Free‑text leakage. Comments and narratives often contain names or contact info; scrub or exclude.
- Email attachments. Easy to forward, hard to control. Use SFTP, portals, or secure workspaces instead.
- Mapping table exposure. If you share the token↔identifier mapping, you’ve undone pseudonymization. Keep it separate and locked down.
- Over‑retention. Old extracts in inboxes and shared drives are common audit findings—set and enforce expiry.
Practice in the wild (checklist)
- Capture purpose, legal basis/DUA, recipients, storage location, and expiry before building the export.
- Use a role‑based template; default to masked IDs and relative dates.
- Run PHI red‑flag checks (MRN/SSN, names, contact info, exact DOBs) and validate structure/codelists.
- Log request, approvals, checksum, and delivery proof in the export register.
- Deliver via secure channel; avoid email attachments.
- Set retention and review dates; retire stale copies.
- Keep mapping tables separate; restrict to need‑to‑know.
Key points to remember
- Start from the minimum necessary—share only the columns, rows, timeframe, and precision required for the stated purpose.
- Default dataset shape: Study ID + coded terms + relative dates; exclude MRN/SSN and direct contact info unless explicitly justified and approved.
- Use role‑based templates/views and automated PHI red‑flag checks; validate structure/codelists and apply small‑cell suppression where needed.
- Prefer pseudonymization/masking; keep any token↔identifier mapping separate, access‑restricted, and time‑limited.
- Replace calendar dates with offsets or bins when allowed; avoid unnecessary precision (e.g., exact timestamps or full DOB).
- Free‑text is risky—exclude or scrub it, and watch for hidden columns/sheets that can leak PHI.
- Secure delivery only: SFTP/approved portals/short‑lived workspaces with encryption and checksums; avoid email attachments.
- Maintain a single export register capturing who/what/why/when/how, approvals, template/report ID or script path, dataset version, checksum, recipients, and expiry—plus delivery proof.
- Tie every export to its legal basis (DUA/contract/protocol/IRB) and set retention; audit and remove stale copies, revoke access when the purpose is met.
- Continuously improve—periodically review and update templates and controls as standards or study needs change.