The national cancer testing program relies heavily on data collection to understand the disease, with researchers using genomic data to analyze tumor genetic structure. To access VHA data sources, agency researchers must follow protocols that include institutional review board (IRB) approval and de-identification of data to protect patient privacy, according to the OIG. Advertisement“By sharing the data file with non-VHA investigators without deidentification or authorization, VA did not follow the requirements of the Privacy Rule or the requirements of HIPAA. Instead, the watchdog found the privacy officer connected with research program leaders but did not report the event to another privacy officer for another two weeks. They also failed to consult subject-matter experts, as required, to review the information in the data file, the watchdog further found.