Coronavirus information for Feinberg.

Skip to main content

Permissible Use Policy FAQ

The official policy regarding permissible use on NMEDW is laid out in the frequently asked questions below.

Policy Questions

 The IRB approved EMR access in my protocol. Does the permissible use policy apply to me?

Yes, this policy applies, even if the IRB approved EMR access in your protocol.

 NMHC provides lab services for my participants. The participants may not be NMHC patients but are registered with the hospital and have an MRN for billing purposes. Do I need to use the EDW to acquire these lab values?

Yes, the policy applies to all clinical data retrieved from an NMHC EMR or other clinical systems that is to be used for research purposes.

 Does this policy apply to case report forms and other research data captured outside of Epic or Cerner?

The policy applies to data residing on NMHC systems (e.g. Epic, historical Powerchart, or other electronic systems). While this policy does not apply to research data captured in systems outside of NMHC, no chart or EMR data may be copied into any third-party system (e.g. investigator-initiated patient-reported outcome surveys).

 Why do I need to request an exception?

The preferred method of reviewing electronic health record data for research purposes is through an EDW report. Where there is a convincing reason to review data in a participant/patient’s chart, FSM policy requires an approved exception.

 What do I need to submit to be considered for an exception?

  1. Send an email to with an initial request.
  2. After reviewing your request, the NMEDW Support Team will send you a form to complete to begin the exception/documentation process. Click here to see an example of the form. Please be as detailed as possible when filling out the form. The more information that we have, the quicker the process will go.
    1. If additional study team members also need EHR access, please be sure to fill out the survey question that says "Please list the Northwestern University NetID of other users on this study who require access to the EMR."
  3. You will need an approved data security plan submitted with your IRB submission.
    1. Your IRB protocol and data security must specify that you will access the electronic health record during the study. Also, your request may not include any data elements that are not specifically outlined in your approved documents.
  4. Upon collection and review of the documents outlined above, an exception request will be submitted into the queue for review.

 What is the process once I have submitted my exception request?

  1. The NMEDW Support Team will review your submitted form and submit the request to EDW management for final review. Should EDW management have questions about your request, they will reach out to you via email. EDW management review takes two to three business days.
    1. Should your exception/documentation request require further review by the FSMIT Steering Committee, this will take an additional two to three business days.
    2. If your IRB protocol must be modified or your data security plan is not approved, this time will be extended.
  2. Once your exception is approved, the Principal Investigator (PI) of your study will need to sign an attestation. Click here to see an example of the attestation form. Please notify your PI to expect the attestation. The attestation will be sent to their email and will come from
  3. After the exception or documentation is approved and your PI signs the attestation form, additional attestations will be sent out to the other requested study team members. Additional attestation form(s) will be sent to the user(s)  within one business day of the NMEDW Support team receiving the request.
  4. If you are eligible to come through the NMHC Research Access Program (employees of NU, permanent or temporary) you can email to initiate the IT ticket to obtain EMR access. If you have already initiated a request, you can contact to request a status update.

 What is the process once I have an approved exception request, but we need to add a new study team member?

  1. Once an exception is approved, submit the name of the individual to be added to the study to
  2. As long as the reason for the exception is the same as already approved and the staff member is on the IRB authorized personnel list, the exception will be quickly processed.

 I have a waiver of consent and a waiver of HIPAA authorization. Does this process change?

The process is the same as described above, but also requires your IRB approval letter stating that you have both a waiver of consent and a waiver of HIPAA authorization.

 How do I know if my data security plan is approved?

You should contact if you have questions about your data security plan.

Types of Data & Chart Review

 I need data from free text notes (e.g., RN notes, progress notes, radiology reports). How do I get free text data from NMEDW?

The NMEDW contains free text notes that can be provided to you in a report format. You may review the notes in the report to abstract notes, just as you would by accessing the chart in the EMR.

 I need to browse the medical record to abstract information from free text fields. Using the EDW report format would take much longer than simply browsing the user interface of the EMR. Do I still need to use the EDW to be compliant with this policy?

Data abstraction from the EMR requires an approved exception to the permissible use policy.

 I need to view the chart for the purposes of clinical care. Do I have to use the NMEDW for clinical care?

Such activities may only be conducted at covered entities such as NMHC, Lurie Children’s Hospital and Shirley Ryan AbilityLab. Those organizations govern how such activities may be conducted.

 I need to view the chart for the purposes of research patient safety. Do I have to use the NMEDW for patient safety?

Monitoring the medical record for research participant safety may be done with an approved EDW exception.

 Can I still use an NMHC system (e.g., Epic, Cerner, OTTR) in order to validate or verify data from EDW that was used in publication?

Data abstraction, including data validation, from the EMR requires an approved exception to the permissible use policy.

Real-Time Needs

 We have an acute need to identify participants in real time in the clinic. Can I access real-time data in the NMEDW for this purpose?

You may access the medical record to identify participants for recruitment purposes, as long as you have documented this need with the EDW through the exception process. You may only remove information from the record that would allow you to contact the participant. This does not include inclusion/exclusion criteria. This data may be viewed for recruitment purposes, but not removed until a consent is signed. The data can then be accessed via the EDW report.

Non-EDW Data

 How does the policy apply to data that isn’t in the NMEDW, such as image data?

The NMEDW contains the clinical data from NMHC systems, including image annotations. Images themselves are not in the EDW, and access to images will soon be managed by a consolidated system. Requests for this type of data should still be submitted to the EDW so they may be documented.

 I need to acquire data from PDF files attached to the medical record. Can I access PDFs and scanned documents in the EDW?

No, the EDW does not contain scanned documents. The Health Information Management department at NMHC can assist in obtaining copies of scanned documents.

 I use analytical and self-query tools in an NMHC system such as Syngo to acquire data for research purposes. Will the complex and proprietary query login of this system be re-created in EDW so I can perform the same queries in EDW?

In cases such as these, please send an email to so we may better understand your data needs and recommend the best path forward.

Industry-Sponsored Studies

 Can industry monitoring and quality assurance personnel continue to log in to the EMR during treatment and the follow-up period?

Yes. Provided no data is copied out of an NMHC system, chart review for monitoring purposes is permitted. This means you can verify the information you already have, but you cannot copy facts from the medical record, including MRNs, lab values, demographics such as address or phone number or any other piece of information into a spreadsheet, a piece of paper, database, or any other medium for data storage.

 I have a site visit from my study’s sponsor, who must review source documents related to the study. Currently, as required by study sponsors and Good Clinical Practice guidelines, clinical research staff must access the medical record at the time of the visit in order to provide the necessary information.

You can continue to do so, but as with chart reviews, no data is to be copied out of an NMHC system. This means you can verify the information you already have, but you cannot copy facts from the medical record, including MRNs, lab values, demographics such as address or phone number or any other piece of information into a spreadsheet, a piece of paper, database or any other medium for data storage.

Participating Institutions: