Appendix 1 - LIST OF DOCUMENTS NEEDED TO SUPPORT APPLICATION

Sep 12, 2026

Uploaded by Theodore

Appendix 1 provides a recommended checklist of supporting documents required to complete the NEST Mark: Real-World Data Source Tool submission. It structures requirements across governance and quality management, data consistency, versioning, ETL and technical controls, data integration and linkage, and data access, sharing, privacy and security. The appendix further covers representativeness, continuity of care, longitudinality, and quantitative characteristics such as coverage, missingness, and linkage validation metrics, including preferred examples and templates.

LanguageEnglish

CategoryForms

FormatPDF

Pages2

Reading Time1 min

AccessFree to download

Appendix 1: LIST OF DOCUMENTS NEEDED TO SUPPORT APPLICATION

Section 1: General Data Holder and Data Source Information

Section 2: Governance and Quality Management System

Section 3: Data consistency & Stability and Quality Control Framework

Section 4: Data Accrual, Traceability, and System and Data Source Versioning

Section 5: ETL and Technical Controls

Section 6: Data Integration & Linkage

Section 7: Data Access & Sharing, Privacy & Security, and Regulatory Transparency

Section 8: Data Source Representativeness, Continuity of Care, and Longitudinality

Section 9: Quantitative Data Source Characteristics

Appendix 1 : LIST OF DOCUMENTS NEEDED TO SUPPORT APPLICATION The following is a recommended list of supporting documents to facilitate completion of the tool and to provide as part of your NEST Mark: Real-World Data Source Tool submission , as applicable to your data source. Section 1: General Data Holder and Data Source Information • Priority ☐ Standard “data source description”(what it is; how it’s captured; known limitations) ☐ Prior RWD use/credibility: list of notable publications and/or regulatory use cases (if any) ☐ Documentation on how medical devices are identified in the data source Section 2: Governance and Quality Management System • Priority ☐ Governance overview (including organizational chart , roles [including data stewardship roles] and responsibilities and escalation) ☐ QMS/quality program overview (or QA program description) and Corrective and Preventive Action (CAPA) processes ☐ SOP index or controlled document list ☐ SOP on SOPs (process for developing, approving, updating, and training on SOPs) ☐ Change control policy / Versioning SOP and change log ☐ Incident/problem management policy with sample redacted incident ticket or postmortem template ☐ Subprocessor inventory and functions (cloud/ETL/de-ID/linkage/analytics) ☐ Training and competency program (beyond SOPs) ☐ Regulatory compliance SOP (audits and inspections) ● Preferred ☐ Internal audit process summary with example of an audit finding and resolution (redacted) ☐ Sample external audit and/or inspection reports ☐ Formal RACI for data curation and release sign-offs ☐ Research Integrity and research methodologies SOP (as applicable) Section 3: Data consistency & Stability and Quality Control Framework Section 4: Data Accrual, Traceability, and System and Data Source Versioning Section 5: ETL and Technical Controls Section 6: Data Integration & Linkage • Priority ☐ Data accrual / capture SOP and documentation (including data entry guidelines, edit checks, coding guidelines, automatic data feeds, etc. ) ☐ Data provenance / traceability SOP and reports from original source to “research-ready” database ☐ Data model/schema documentation + versioning approach ☐ Data dictionary + coding/terminology mappings (ICD, CPT/HCPCS, LOINC, etc. ) ☐ ETL architecture overview (including diagrams) ☐ ETL and integrity/completeness checks SOP (Extraction, loading, transformation. Include validation of transformations and methods to demonstrate completeness, with respect to the data dictionary) ☐ Source-to-target mappings / lineage documentation ☐ Data quality control (QC) and accuracy SOP (edit checks, thresholds, verification, escalation steps used)☐ Data quality assurance (QA) SOP (Please provide with respect to the data dictionary) ☐ Sample QC/QA report(s) and evidence of issue closure (redacted) ☐ Logging/monitoring and audit log retention policy ☐ Audit trails SOP ☐ Data linkage SOP / process documentation (within the data source and/or with other data sources) and reports ☐ Software validation SOP (Software development life cycle (SDLC) and system validation) ● Preferred ☐ Automated lineage tool output (if available) ☐ Formal validation test scripts/checklists used for releases Section 7: Data Access & Sharing, Privacy & Security, and Regulatory Transparency • Priority ☐ Data provenance and rights statement (who provides the data; authority to use/share) ☐ Template DUA/BAA (redacted acceptable) and data use policy ☐ Access request/approval workflow (how projects are approved; criteria) ☐ Retention and destruction policy ☐ De‑identification methodologies and applicability SOP (Safe Harbor and/or Expert Determination summary)☐ Re-identification risk management approach (thresholds/mitigations) ☐ Tokenization/pseudonymization approach (if used) ☐ Disclosure control rules for outputs (e.g. , min cell size/suppression policy) ☐ System and data security program overview

FAQs

What general supporting documents are prioritized for the data holder and data source information?

Provide a standard “data source description” detailing what it is, how it’s captured, and known limitations. Include any prior RWD use/credibility and documentation on how medical devices are identified in the data source.

Which governance and quality management system documents are expected?

Include a governance overview with organizational chart, roles, responsibilities, and escalation; a QMS/quality program overview including CAPA processes; an SOP index or controlled document list; and change control/versioning with a change log. Also include incident/problem management policy and relevant training and regulatory compliance SOPs.

What privacy, security, and regulatory transparency materials should be included?

Provide a data provenance and rights statement, a template DUA/BAA and data use policy, an access request/approval workflow, retention and destruction policy, and de-identification methodologies with appropriate SOP references. Include re-identification risk management, disclosure control rules, the system/data security program overview, and evidence such as SOC 2 Type II or ISO 27001 scope where preferred.

Sep 12, 2026

Uploaded by Theodore