Privacy Notification Procedure / Research Section

The distinction between quality assurance and research can be difficult. If you are unsure which category the project falls under, we recommend contacting SSHF’s Data Protection Officer (PVO) and/or REK for clarification. A quality project may identify issues that will later be studied in a research project. If the project’s status changes, an application must be submitted to REK for approval as soon as possible.

 

Research aims to establish new knowledge, not to evaluate existing treatment. As a general rule, research projects must be approved by REK and require the research participant’s consent, cf. Informed consent.

 

Characteristics indicating that the project is a research project:

 

 

While research is about acquiring new knowledge about what is, or should become, best practice, a quality study is about finding out whether best practice is being followed.

 

Quality assurance can be defined as projects, surveys, evaluations, etc. whose purpose is to check that diagnosis and treatment actually produce the expected results. For example, the aim may be to improve the efficiency and/or quality of treatment.

 

The National Committee for Medical and Health Research Ethics (NEM) has prepared a checklist that may be helpful in the assessment:

 

If the answer to 1 and 2 is “yes”, and to 3 is “no”, then the project is probably a quality study. Otherwise, it is probably research.

 

The project manager or the project’s contact person must complete the notification form:

 

 

Select the option "Health research"

 

The following documentation must be uploaded when completing the notification:

• Copy of the REK application with all attachments
• REK approval (all approvals, if there have been multiple rounds with REK)
• Protocol / project description
• Information and consent form
  
  

Before health and personal data can be disclosed to an externally managed health research project, a notification must be sent to the Data Protection Officer at SSHF. The Data Protection Officer is responsible for assessing the basis for disclosure. The Information Security Manager must also ensure that information security is maintained during collection and disclosure.

 

The project’s contact person must complete the notification form:
Notification to the Data Protection Officer and Research Section - SSHF - Nettskjema
Select the option "Disclosure for health research"

 

Upload the following documentation in the form:

• Copy of the REK application with all attachments
• REK approval (all approvals, if there have been several rounds with REK)
• Protocol / project descriptionInformation and consent form
• Any approval from the department manager at SSHF

Research that falls outside REK’s remit must be reported to the Data Protection Officer.

 

This also includes quality studies that are not governed by the provisions on internal quality assurance.

 

The project manager or the project contact person must complete the notification form:

​ 

Upload the following documentation in the form:

• Protocol / project description
• Information and consent form
• Other relevant documentation, such as participant questionnaires
• The project must not start until the Data Protection Officer has issued a recommendation.

 

The Patient Records Act Section 6 and the Health Personnel Act Section 26 provide a legal basis for projects and registries established by a manager to carry out internal control and quality assurance of healthcare. A management decision and a recommendation from the Data Protection Officer are required.

 

The project aims to improve patient treatment at the hospital, for example through improved diagnostic or treatment methods. This is an internal purpose intended to ensure continuous improvement and, where relevant, to support adjustments to treatment so that changes to treatment regimens achieve at least the same or better results.

 

Neither patients nor their next of kin are directly involved. No new information is collected from patients or other external sources; only information already collected as part of healthcare and recorded in the organisation’s consolidated patient record is used.

 

The purpose is limited to internal activities and needs. It does not include publication of results. Any need to publish results must be specified as an additional purpose. A decision to publish results will require an assessment of the rationale for establishing the quality registry, its purpose, and the assumption that it serves an internal purpose.

 

The department’s contact person must complete the notification form:

 

The establishment of a health registry with a broad thematic purpose related to research, including nationwide quality registries, must be reported to the Data Protection Officer. Such registries will generally require a documented Data Protection Impact Assessment (DPIA).

 

The Data Protection Officer can be contacted for advice on preparing this assessment.

 

The project manager or the project contact person must complete the notification form:

 

 

Select the option “Broad registry”.

 

Upload the following documentation in the form:

• Protocol
• Bylaws, seetemplate from SKDE
• Information and consent form
• DPIA, if available

The Data Protection Officer’s recommendation must be in place before registration can begin.

 

 

Before health and personal data can be disclosed to an externally managed project or registry, whether for quality assurance or other research outside REK’s remit, a notification must be sent to the Data Protection Officer at SSHF. This applies even if the external party has received a recommendation from its own Data Protection Officer. The Data Protection Officer must assess the basis for disclosure. The Information Security Manager must also ensure that information security is maintained during collection and disclosure.

 

The project contact person must complete the notification form:
Notification to the Data Protection Officer

Select either “Research outside REK’s remit” if data are to be disclosed to a project, or “Registry with a broad purpose” if data are to be disclosed to a registry.

 

Upload the following documentation in the form:

• Recommendation from another Data Protection Officer
• Protocol / project description
• Information and consent form, or a copy of the exemption
• If data are to be disclosed to a registry: the registry’s bylaws

The recommendation for disclosure from the Data Protection Officer at OUS must be in place before the project starts and data are disclosed.

 

SSHF has its own procedure for master’s projects; seeData collection - master’s students (sshf.no) 

 

Use of the hospital’s time and resources must be approved by the relevant managers.

 

Contact Vivi Haavik TønnessenVivi.Tonnessen@sshf.nofor guidance.

 

 

Before accessing patient records for the purpose of presenting a patient history (in a journal, at a conference, etc.), a notification must be sent to the Data Protection Officer at SSHF. Only SSHF employees are eligible to apply.

 

The project contact person must complete the notification form:

 

PEIK - Data Protection and Internal Controland select "Other research/project"

 

Upload the following documentation to the form:

• Consent template for case study to Ek.docx
• Approval from the department manager 

 

Notifications of changes to previously approved data registrations must be sent to the body/bodies that approved the registrations.

 

If the change affects information security, for example an electronic data collection solution, storage, analysis tools or disclosure, approval from the PVO/Information Security Manager at SSHF must be obtained.

 

An amendment notification is only required if the change concerns the storage location and/or disclosure of data. In such cases, the notification form must be completed:

 

Project registered after 2.2.2026:
PEIK - Data Protection and Internal Control

 

Project registered before 2.2.2026:

Select the option "Amendment notification"

 

All other changes to health research projects must only be reported to REK.

 

The change cannot be implemented until feedback on the amendment notification has been provided by the Data Protection Officer and/or the Information Security Manager.

 

SeeImplementation and data storage.