Existing Data (Also see Data Security FAQs for more information) Identifiable Data: Any information about a living individual that is linked, associated with, or contains the name or any details of the individual that would allow someone to be able to directly or indirectly identify a subject from the information collected. Direct identifiers: Identities of individual subjects are kept by the investigator. If subjects' identities are inseparable from data, then data is directly identifiable. Direct identifiers in research data or records include names; postal address information (other than town or city, state and zip code); telephone numbers, fax numbers, e-mail addresses; social security numbers; medical record numbers; health plan beneficiary numbers; account numbers; certificate /license numbers; vehicle identifiers and serial numbers, including license plant numbers; device identifiers and serial numbers; web universal resource locators ( URLs); internet protocol (IP) address numbers; biometric identifiers, including finger and voice prints; and full face photographic images and any comparable images. Indirect identifiers: Identities are kept separate from data, with information connecting them maintained by codes and a master list. Indirect identifiers in research data or records include all geographic identifiers smaller than a state, including street address, city, county, precinct, Zip code, and their equivalent postal codes, except for the initial three digits of a ZIP code; all elements of dates ( except year ) for dates directly related to an individual, including birth date, admission date, discharge date, date of death; and all ages over 89 and all elements of dates ( including year) indicative of such age, except that such age and elements may be aggregated into a single category of age 90 or older. Anonymous Data is: any information about a living individual that was collected in a manner that identifiers were never associated with the information and that no one was ever able to identify from whom the information was collected. Subjects' identities are unknown to the investigator, not requested, not recorded and not given. There is no possible way that the researcher, research team or anyone else could possibly link the data to the participant. De-Identified Data: identifiers have been removed from the dataset in a manner that any member of the research team is not able to identify the individual from whom such information was collected. Coded Data: identifiers have been removed from the dataset but can readily be found through the use of a master list that is accessible to the investigator. • The link that cross-references the subject’s identity with the code should be stored in a separate location from the data and should be locked. Consideration should be given by the Principal Investigator as to how many and which staff should have access to the link. Limiting the number of staff who have access to the link should be considered for more sensitive high-risk data. Confidential Data: Confidential data is not anonymous. It is the protection of study participants’ data such that an individual participant’s data is protected and will not be disclosed except to another authorized person. Data Transfer: • All electronic transmission of private and sensitive information over the Internet must be *encrypted*. This includes email, file transfers and other data transfer modalities. • Paper transfer: transferred by snail mail, fed-ex, hand carried by member of the study team? Data transfer needs to be protected from a breach (e.g., data transferred separately from consent forms, codes). Data Storage Basic Tips: • Separate data files from consent forms and from master lists (if applicable). • Paper records containing research data should be stored in a locked cabinet with access limited to research team. • Electronic data should be stored in a password protected file (or encrypted if necessary) on a password protected computer in a locked cabinet/desk in a locked office. • Electronic data should be stripped of identifying information as soon as possible. • Master lists should be kept in a separate password protected file (or hard drive) than the coded data set • The level of security and restriction should increase depending on the level of sensitive data being captured in the research records. • Data protection plans must consider all record-keeping processes and storage of data from the initial collection to post-study storage or destruction or complete de-identification of the data. Such plans should include details to all modes of storage: paper, electronic, video/audio recordings, films, etc. • Data storage plans should include notes about keeping all software and protective software up to date Questions to Answer when Handling Existing Data 1. Is the data identifiable or is it anonymous? a. If the data is identifiable, your study does not qualify for Exemption. 2. What is the nature of the data? a. Electronic (audio or text), hardcopy files, or biological specimens? b. Do the data contain protected health information, personal identifying information or other sensitive information? c. Are identifiers retained and linked to the data? Who will have access to the data and identifiers? d. Are the data stripped of identifiers and the identifiers destroyed? e. Are identifiers de--‐linked from the data and managed by use of a code? How are the identifiers, data files and key managed and secured? Who will have access to the identifiers, data files and key? 3. How do you have access to the data? a. Is it appropriate for you to access the data? Is it a conflict of interest? b. Is someone providing you with the data? c. Is the data originally identifiable, but then someone else besides the research team is removing identifying information? 4. How will data be transferred or transported? a. Who is transferring the data to you? b. How will electronic files be transmitted? c. How will hardcopy files be transported? d. How are the files and data protected while in transmission or when transported? 5. Where/how will the data be stored and what security measures will be used for each? a. Office computer? Personal laptop? University laptop? Office file cabinet? Thumb/jump drive? Departmental server, etc.? b. What security measures will be used with each (password protected; encryption; locked file cabinet in locked office, 128 bit encryption, etc.)? c. Who will have access to the computer/laptop/or files? d. Is the computer on a network? e. Is the data behind a firewall? 6. When and how will data be deleted or destroyed? a. Will cloud--‐computing resources be used? (refer to NCSU resources below) b. What is the resource and what is the privacy policy for the resource? c. Do you have a data agreement and is your procedure in line with their stated procedure? 7. Is there a data use agreement? a. Are your practices and expectations in line with what is articulated in that agreement? b. Are you compiling multiple data sets? Does compiling those data sets put the information about the people in those datasets, at more risk because of how you have compiled the data? Best Practices for Data Security in Google Apps at NCSU http://google.ncsu.edu/usinggoogleapps/best-practices-data-security-google-apps-nc-state#AppropriateUse Storage Locations for University Data http://oit.ncsu.edu/security-standards-compliance/storage NCSU Office of Information Technology (OIT) Information Units: http://oit.ncsu.edu/units Training and Consulting: http://oit.ncsu.edu/n/welcome-training-consulting Safe Computing: http://oit.ncsu.edu/safe-computing
© Copyright 2024