Washington University School of Medicine uses Epic as its electronic medical records (EMR) system. Access to Epic, and to the protected health information (PHI) it contains, is strictly governed by federal law and university policy. This page explains the process by which non-WashU employees may request access to Epic for research purposes.
Who the Policy Applies To
This Wash U School of Medicine policy on Non-Employee Access to Epic for Research Purposes applies to non-WashU employees and non-WashU students who need access to Epic for research purposes. This includes, but is not limited to:
- Visiting researchers
- Visiting students and residents (non-WashU)
- Former WashU faculty, residents, and fellows no longer employed at WashU
- Individuals with emeritus status
Note: Individuals in non-appointee or emeritus status are not considered WashU employees for purposes of this policy. Current WashU students, clinical trial monitors, and FDA auditors are excluded from this process.
Preferred Methods of Data Sharing
- WashU Data Extraction — A WashU employee extracts the necessary data and shares it via a secure method under an appropriate agreement (e.g., subaward or data use agreement).
- Data Brokerage Services — Use data brokerage services from Informatics Core Services via standard request procedures.
Direct access to the EMR by non-employees is unusual and requires compelling justification that these alternatives are insufficient.
Application Process
All applicants must work with a WashU Sponsor or WashU Principal Investigator (PI) to submit a request.
Step 1: Submit Questionnaire (Attachment A)
The WashU Sponsor or WashU PI completes and submits the request questionnaire on behalf of the applicant.
Step 2: Committee Review
The completed questionnaire is reviewed by the Committee on Non-Employee Access to EMR/PHI for Research.
Step 3: Attestation (Attachment B)
If the Committee approves access, the WashU PI and Sponsor must complete and submit the attestation form.
Step 4: Pre-Access Requirements
Prior to being granted EMR access, the following must be completed:
- IRB approval covering the applicant
- Signed Data Sharing Agreement with the applicant’s employer/institution (managed by JROC)
- Documentation of contingent worker status in Workday
- Completion of HIPAA 101 training (if not completed within the prior 180 days)
Important: The WashU Sponsor and PI should not contact the Epic team to request access unless and until the Committee has provided approval.
Key Definitions
Applicant: A non-WashU individual engaged in research at WashU who needs access to WashU medical records.
WashU Sponsor: A WashU employee with knowledge of the applicant’s roles and responsibilities, primary responsibility for tracking access and ensuring compliance, and appropriate oversight of ongoing compliance with WashU policies.
WashU Principal Investigator: The WashU faculty member or PI responsible for overseeing the applicant’s research studies. The WashU PI may also serve as the WashU Sponsor.
Forms
Attachment A: Request for Non-Employee Access to EMR
Attachment B: Attestation Regarding Non-Employee Access to EMR
Questions?
For questions about this policy, contact Melanie Roewe, Associate Vice Chancellor, Research Operations & Policy, at roewem@wustl.edu.