Research Requests for Data Containing Protected Health Information

Basic Science, Clinical, and Translational Research are important parts of the EVMS research enterprise and goals, and the EVMS educational process.   Any research that contains protected health information (PHI) will require IRB approval, adhere to the guidelines developed by the owner of the primary data, the EVMS Institutional Compliance Data Use Requirements, and the HIPAA Privacy Rule. The information below is provided to ensure that all data requests are compliant with the minimum necessary requirements of the HIPAA Privacy Rule, and all research team members must familiarize themselves with the relevant policies and acknowledge their willingness to adhere to them.

General Requirements for Obtaining Medical Records Data:   

  • REDCap Account:  REDCap is a secure web application for building and managing online surveys and databases. While REDCap can be used to collect virtually any type of data in any environment (including compliance with 21 CFR Part 11, FISMA, HIPAA, and GDPR), it is specifically geared to support online and offline data capture for research studies and operations. All patient data used for research must be stored in REDCap. All EVMS Faculty, Staff, Trainees and Collaborators are eligible to have REDCap accounts.
  • IRB Review is required.
    • Requesting aggregate data from EVMS Medical Group or Sentara to determine the feasibility of a study does not require IRB Review or Approval.
  • Projects involving EVMS students as the research subjects must receive approval from Student Affairs prior to protocol submission to the IRB office.
  • All research team members conducting Human Subjects Research (as defined by the EVMS IRB) must have current CITI Program Training. Research team members may self-enroll in the courses. For questions regarding course requirements, contact the EVMS IRB.   
  • Data Privacy Forms must be signed by the principal investigator (PI) and all research team members.
  • The project protocol must contain well defined data elements - the HIPAA Privacy Rule requires that use or disclosure of data will be limited to the amount of data that is “minimally necessary” to answer the study question and accomplish the study aims. Thus, the number of participants in the cohort should be estimated using a statistical power calculation that is included in the study protocol. The participants should then be defined in the data request by the inclusion/exclusion criteria and the date ranges of study. Also, requested study variables should be justified by the study’s methods and aims. 
  • Students must work with Dr. David Mu to facilitate their requests and must have a faculty mentor.

How do I Request Electronic Medical Records Data for Research from Sentara?

Note:  A REDCap account is required.  Accounts can be requested at

  1. Complete the EVMS Data Request Intake Form. This is required for all research data requests, including those submitted to HADSI. The intake form will automatically capture the required acknowledgments/data use attestations for the PI.  The PI is responsible for having all research team members sign the form once the project is approved.   Team members can sign electronically via REDCap.  
  1. All approved intake forms will be assigned a project number from the Research Office.
    1. For HADSI Projects:  
      1. Once the project requester has the project number, the intake form will go to HADSI to determine if this is a project they want to accept:
      2. If so, HADSI can proceed with the data pull from Sentara's portal (or other sources) with the assigned project number;
      3.  If not, HADSI will reject the project and it will be routed back to Research Office  to determine if/when they can make a direct request through the portal.
    2. For Sentara (EPIC Clarity) Data (including chart review requests):   
      1. Once the project requester has the project number, contact the Research Data Coordinator at
      2. All students and residents must have a faculty supervisor who will have ultimate responsibility for ensuring the proper conduct of the proposed research.
      3. All data requests made by EVMS Faculty, Staff or Students must be submitted using the Sentara Health Research Center’s portal  and will be coordinated by the EVMS Research Office.
        1. Requests should include clear definitions for each Epic variable. Epic variables must be specific (i.e., all medications of interest must be listed by name, all procedures and/or diagnoses of interest must be specified and codes included, any calculated variables must include how the variable will be calculated and what Epic variables are required to calculate the variable of interest). Where possible, researchers should note how the data are documented in the Epic record.
        2. Requests must include a detailed plan for data transfer, data security, and data destruction following HIPAA guidelines.
        3. All requested data will be delivered directly into the project requestor’s REDCap project. A copy of the Codebook and the Data Import Tool Worksheet need to be provided to Sentara via the SHRC portal (see CodeBook and Import Tool Section below).
      1.      Questions regarding the proper method for requesting data from Sentara can be addressed to the EVMS Research Office at
    1. REDCap CodeBook and Import Tool
      1. To Print the CodeBook
        1. Open Your project in REDCap
        2. Click on Codebook Under Project Home and Design
        3. Click Print Page and then Print to PDF
      1. To Download the Data Import Tool Template
        1. Click Data Import Tool under Applications
        2. Click Download your Data Import Template (Records in Rows)
    1. IRB approval does not confer Sentara or other data holder approval and data holders may deny any data request. For denied requests, contact the Research Office at
  1. All requests for data will be reviewed by Sentara or the data holder to ensure compliance with their policies and guidelines.
  • An active IRB approval is required for EVMS Medical Group and Sentara to allow use or disclosure of data for a formal research analysis (beyond preparatory to research). The approved protocol must include each member of the research team. An approved IRB addendum is required if additional research personnel are added or the project is amended at a later time.

 How do I Request Electronic Medical Records Data from other Covered Entities?

  1. Complete the EVMS Data Request Intake Form. This form is required for all research data requests, including those submitted to HADSI.  The intake form will automatically capture the required acknowledgments/data use attestations for the PI.  The PI is responsible for having all other research team members sign the forms once the project is approved.   Team members can sign electronically via REDCap.  
  2. Follow the procedure of the entity from which you are requesting the data.
  3. If you are asked to complete a Data Confidentiality Agreement, Data Use Agreement or other contract or agreement to use the data, please contact the Research Office at to coordinate with EVMS legal. You do not have authority to sign agreements on behalf of EVMS. 


Virginia Health Information (VHI) is a dataset, which includes de-identified, inpatient data from VA hospitals. This data has been purchased by the Brock Institute and has data support via HADSI. Data includes patient demographics, hospital information, clinical diagnosis, costs, and readmissions.

To make a VHI request:

  • Submit a Service Request Form to HADSI, indicating VHI as data source and provide a protocol with a list of requested variables: HADSI Service Request Form.
  • HADSI Data Manager will then check the availability of the requested variables and send a VHI/Brock Institute Agreement Form to the PI for signatures before beginning data extraction.

TriNetX is global health research network that provides updated, de-identified and aggregated data from various health systems from around the world. TriNetX provides researchers the ability to explore a limited, de-identified set of patient data. This may be most helpful for identifying patient cohorts when preparing for a research study.

If you are interested in getting a training account for TriNetX, please do the following; 

  1. Go to: SENTARA Research Data Request Portal
  2. Pick Preliminary Analysis
  3. Complete, Sign and upload this Sentara attestation Form
    Download SENTARA Data Use Attestation
  4. Select Yes for “Are any research team members from Eastern Virginia Medical School (EVMS)?”
  5. Enter 9999 as “EVMS Office of Research Data Request Number(#) “
  6. Enter TriNetX Training Account in Question you are asking
  7. Enter your EVMS Program (MD/Year, School of Public Health, etc.) for What data will you need?
  8. Click TriNetX for Data source

To make a TriNet X request:

  • Complete the EVMS Data Request Intake Form. Select one of the two TriNetX options under Request Type.
  • Requesters will receive a confirmation email with account credentials and required training.
  • Users can then access TriNetX data at: TriNetX Login.

HADSI Research Training and Resources

  • HADSI offers data analysis services and supports research to move the healthcare community forward.
  • Information about HADSI Resources can be found at the link above. 


MedDRA now available at EVMS

EVMS has an institutional license to MedDRA (Medical Dictionary for Regulatory Activities), a clinically-validated international medical terminology used by regulatory authorities, including the FDA. It is also used by industry, academics, health professionals and other organizations to communicate medical information.

MedDRA is a standardized dictionary of terms used to describe adverse events of drugs and therapeutic biologic products in animal and clinical trials. Medical terms are linked to capture logical relationships, making it possible to create meaningful summaries and conduct analyses.

MedDRA Login Page: MedDRA

There is a training session for MedDRA on Aug. 4th at 2pm EDT. Please register at the following site:

The EVMS institutional username (ID number) and password are available through the EVMS MyPortal at this link (Credentials).

Per our agreement with MedDRA, please do not share these with non-EVMS associates.

MedDRA includes standardized terms for:

  • symptoms, signs, diseases, syndromes and diagnoses
  • medical device malfunctions
  • medication errors
  • medical, social and family history information
  • sites (e.g. application, implant and injection sites)
  • medical and surgical procedures
  • approved uses for medications and medical devices
  • types of investigations (e.g. liver function analyses, metabolism tests).

MedDRA terminology incorporates terminology from the following agancies:

  • Medicines and Healthcare products Regulatory Agency (MHRA)
  • World Health Organization Adverse Reaction Terminology (WHO-ART)
  • International Classification of Diseases (ICD)
  • International Classification of Diseases and Clinical Modification (ICD-CM)
  • Coding Symbols for a Thesaurus of Adverse Reaction Terms (COSTART)
  • Japanese Adverse Reaction Terminology (J-ART).

(adapted from

Additional information about MedDRA is available at the following sites: