Table 2.

Qualitative spectrum of criteria and procedures in data use and access governance in CDW

MAIN CATEGORY	SUBCATEGORY	SUBCATEGORY	SUBCATEGORY	SUBCATEGORY
REQUIREMENTS
	Recipient	Recipient categorization	Roles
			Status	Authorized vs. non-authorized
				Internal vs. external
		Recipient background	Professional background	Academic staff
				Healthcare professionals
				Office staff
				Researchers
			Other background	Organizations
				Patients
				Students
		Recipient qualifications	Human-subjects training
		Recipient relation to CDW	Affiliation
			Reciprocity
	Reuse	Reuse purpose	Research purposes	General research
				Clinical trials
				Epidemiological studies
				Feasibility check for research
				Health services research
				(Non-)human subject research
				Observational studies
				Personalized treatments
			Health care purposes	Audit
				Care management
				Clinical care coordination
				Clinical quality improvement
				Facilitating organ, eye or tissue donation and transplantation
				Public health reporting
			Other reuse purposes	Grant application support
				Marketing
		Reuse setup	Clear documentation provided
			Dissemination plan provided
			Feasibility assessment provided
			Funding provided
			Process details provided
		Reuse risk mitigation	Data protection
			HIPAA compliance
			IRB authorization
			No contacting data subjects
			No reidentification
			No resharing without approval
		Reuse values	Ethical soundness	Responsibleness	Compliance
					Privacy
					Responsible reuse
				Patient-centricity	Clinical relevance
					Patients first
				Non-competitiveness	Business issues
					Collaboration principles
					Non-profit
			Scientific soundness	Good research conduct
				Innovation
				Merits
			Appropriateness	Appropriateness of requests
				Appropriateness of results
				Mission consistent with CDW
				Reputation
	Formal requirements	Data reuse documents	Data access/ sharing/ use agreement
			Data collaboration agreement
			Ethical agreements
			Honorary/ substantive contract
			Participation agreement
			Term license agreement
		General policies and regulations	Ethics	Consent
				IRB approval
			Laws	General laws
Specific laws
Other general policies and regulations	FAIR principles
	Statewide policy guidance
Local policies and regulations	Information governance
	Data access policies
	Data identifying/ access/ sharing/ publishing protocols
	Data management policies
	Privacy/ security policies
	Protocol review guidelines
	Research policy
	SOPs
Fees
STRUCTURES AND PROCEDURES
	Review bodies	Governance bodies	Board of directors
			Clinical committee
			Department head
			Director of professional services
			Executive board
			IRB
			Project review committee
			Privacy board
			Privacy and security committee
			Policy advisory groups
			Use and access committee
			Working groups
		Scientific review bodies	Academic staff
			Data analysts
			Health information research unit
			Research committee
			Scientific peer-review
		Patient review bodies	Patient-led oversight committee
	Review values	General values	Appropriate competency
			Fine-grained control
			Holistic governance
		Reducing bias	Empirical evaluation
			No conflict of interest
			Objective review
			Transparent review
		Reducing investment	Effective review
			Timely review
		Managing competitiveness	Collaboration
			Community before individual
ACCESS
	Access limitations	Limited data	Aggregated data set
			De-identified data set
			Limited data set
		Limited location	Remote access
			View only
			Virtual access
		Limited time