Phase 1: Patient ID & Outreach
Applies to: Subject ID system, sourcing, and folder setup
Sequence note: Phases 0-4 sequential; phase 10 anytime; not all phases apply
What you'll learn
- Assign and protect subject IDs immediately upon patient identification, never logging real names in shared trackers or Teams.
- Conduct pre-consent outreach exclusively through company-controlled accounts using the approved script, with no health questions or profiling.
- Log every outreach outcome immediately and apply the correct next action, including permanent suppression for declines or removal requests.
Lesson
Step 1-2: Establish the Subject ID System and Create a Target Patient Profile
Before any patient contact, create a restricted document that maps subject IDs to real names and store it in a restricted SharePoint folder. Use subject ID-only naming (e.g., SUBJ-012) for all references. Separately, create a target patient profile aligned with the client brief. Approved sourcing channels are social media, HCP referral, client referral, and patient advocacy groups (PAGs).
Source: slide 6 - Patient Data Storage and Access Control_Final_8-2026
Step 3-4: Source a Candidate and Assign Subject ID Immediately
Once a candidate patient is identified, assign a subject ID immediately. Log the subject ID, source channel, date, and staff member. Do NOT log the patient's real name in any shared tracker or Teams channel.
Source: slide 6 - Patient Data Collection and Consent Guidance_Final_8-2026
Step 5: Request a SharePoint Folder via IT Ticket
Submit an IT ticket to create the patient's SharePoint folder. The ticket and folder MUST contain: subject ID, client name, and folder structure. The ticket and folder MUST NOT contain: patient name, date of birth, SSN, or any PHI. Folder naming uses subject ID only - no names, DOB, or PII. Required sub-folders: Consent, Contract, Financial, Engagement, Deliverables.
Source: slide 6 - Patient Data Storage and Access Control_Final_8-2026
PROHIBITED: No PHI in Folder Names, Trackers, or Shared Channels
Patient names, dates of birth, SSNs, and any other PHI must never appear in folder names, shared trackers, Teams messages, or IT tickets. Violations of this rule represent a PHI exposure risk and must be reported immediately.
Source: slide 6 - PHI Handling and HIPAA Safeguards_Final_8-2026
Step 6: Conduct Pre-Consent Outreach Using the Approved Script
All outreach must use a company-controlled Outlook account - never a personal email. The required subject line format is: 'Invitation to Share Your Experience - [PROGRAM/DISEASE AREA]'. No PII may appear in the subject line. The outreach message must contain no health questions, screening questions, or patient profiling. For patients identified from public sources (not referred), only one initial contact attempt is permitted if there is no response.
Source: slide 7 - Patient Engagement Outreach & Screening Script Library - V1.4
Step 7: Log Outreach Outcome Immediately in the SharePoint Tracker
Record the outcome, date, and staff member in the SharePoint tracker immediately after each outreach attempt. The four outcomes and required next actions are: (1) Interested - proceed to Phase 2 (Consent); (2) Declined - log as suppressed, no further contact, no data retained beyond the suppression record; (3) No response - one follow-up is permitted, then log as non-responsive and stop contact; (4) Removal request - immediately remove from all lists.
Source: slide 7 - Patient Data Collection and Consent Guidance_Final_8-2026
HARD STOP: Declined or Removal Requests End All Future Contact Permanently
Once a patient declines or requests removal, they may never be re-contacted for any program. This prohibition is permanent and applies across all programs, not just the current engagement. No exceptions exist for this rule.
Source: slide 7 - Patient Data Collection and Consent Guidance_Final_8-2026
Scenario
You identified a patient through a public social media post discussing her condition. You sent the approved outreach email two weeks ago using your company Outlook account. Today you receive no reply and no response at all. You also notice that a colleague logged this patient in the shared Teams channel by her first name and city.
The patient from the public social media post has not responded to your initial outreach email. What do you do next?
Correct. For public-source patients, one follow-up is permitted after no initial response. After that, log as non-responsive and stop all contact.
Incorrect. Only one follow-up is permitted for patients who did not respond to initial outreach. Multiple follow-up attempts are not allowed.
Incorrect. All outreach must use a company-controlled Outlook account. Personal email accounts are never permitted for patient contact.
Incorrect. You must not advance to a later phase until outreach produces an 'Interested' outcome and is properly logged. Preparing consent materials without confirmed interest is premature.
You see that a colleague logged this patient in the shared Teams channel using her first name and city. What action is required?
Incorrect. Patient names combined with any identifying detail (such as city) can constitute PHI. Real names must never appear in shared trackers or Teams channels.
Correct. Patient real names must never be logged in shared channels or trackers. This is a PHI handling violation that must be escalated, not simply edited and forgotten.
Incorrect. While replacing the name with the subject ID is the right data correction, a unilateral edit without escalating the incident is insufficient. PHI exposures require formal reporting.
Incorrect. A PHI exposure in a shared channel requires immediate escalation through proper channels, not an informal private notification.
Knowledge Check
Select an answer to see feedback. This is practice - it does not affect your score.
When must a subject ID be assigned after a candidate patient is identified?
Correct. The subject ID must be assigned immediately upon identification.
Incorrect. Assigning the ID before outreach is too late - it must happen immediately upon identification.
Incorrect. Waiting until the patient expresses interest violates the immediate assignment requirement.
Incorrect. The ID must be assigned immediately, not tied to a later administrative step.
Which of the following is PROHIBITED in the IT ticket when requesting a patient SharePoint folder?
Incorrect. The subject ID is required in the IT ticket.
Incorrect. The client name is required in the IT ticket.
Correct. The patient's date of birth (and all other PHI such as real name and SSN) must never appear in the IT ticket.
Incorrect. Including the folder structure is part of the required ticket content.
A patient responds to your outreach email saying she is not interested. What is the correct next action?
Correct. A declined response means log as suppressed, stop all contact, and retain no data beyond the suppression record.
Incorrect. A decline ends all contact immediately - no follow-up is permitted.
Incorrect. A decline is not the same as no response. The patient may never be re-contacted.
Incorrect. Once a patient declines, they may never be re-contacted for any program.
Key Controls Recap
- [RULE] Step 3-4: Source a Candidate and Assign Subject ID Immediately
- [RULE] Step 5: Request a SharePoint Folder via IT Ticket
- [WATCH OUT] PROHIBITED: No PHI in Folder Names, Trackers, or Shared Channels
- [RULE] Step 6: Conduct Pre-Consent Outreach Using the Approved Script
- [WATCH OUT] HARD STOP: Declined or Removal Requests End All Future Contact Permanently
You've completed the Phase 1 learning module.
Return to Dayforce and take the Phase 1 quiz.