University of Alaska Fairbanks (uaf) Institutional Review Board (irb)

electronic human subject research data

These guidelines apply to Full and Expedited research projects involving electronic data with either: a) personal identifiers* OR b) information of a personal or health nature. Studies that collect neither or are determined to be “Exempt” research should still employ adequate data protection measures, both to protect the loss of valuable research data and to be responsible stewards of participant data.

a. Research files are protected by a firewall and encryption OR

b. Research data files are separate from any personal identifiers (linked by a key) and both files are password protected and the server or PC is also password protected
2. Laptop devices

a. Device uses software that automatically encrypts research files or device uses full disk encryption OR

b. Research data files are separate from any personal identifiers (linked by a key) and both files are password protected and the laptop is also password protected
3. Jump drives, CDs or DVDs:

a. Device uses software that automatically encrypts research files or the entire device is encrypted OR

b. Research data files are separate from any personal identifiers (linked by a key) and both files are password protected and the device is also password protected
4. PDAs, iPODs Android and Blackberry devices.

a. Device uses software that automatically encrypts research files OR

b. Research data files are separate from any personal identifiers (linked by a key) and both files are password protected and the device is also password protected
Web-based survey research
The two most common types of web-based surveys:
1. Investigator-devised and programmed survey tools housed on university servers under the control of the investigator;

1. 
   Research data with personal identifiers should be submitted directly into a secure web server (“https”) and the server should encrypt any personal identifiers upon submission and be behind a firewall.
   
2. 
   Web-based anonymous or de-identified data do not need to be encrypted and firewall protections are advised but not essential.
   

2. Independent proprietary vendors of web-based survey tools are generally ethical, but investigators are expected to obtain information about the security and privacy protections, including whether the tool captures and saves user IP addresses during completion of the survey;

1. 
   Request that vendor ‘scrub’ IP addresses upon submission of the completed form. Some vendors, especially those that promote freeware, do in fact collect and share respondents’ IP addresses with their consortium of investors for marketing and sales purposes and therefore cannot guarantee absolute anonymity to survey respondents.
   
2. 
   Request that vendor ‘scrub’ IP addresses from the data before it is provided to the investigator.
   

With either method, the informed consent forms and scripts must clarify the protections available to the web-using participant. Just as consent forms describe protections of hard copy research materials locked in file cabinets, consent forms for internet-based research should describe the specific web-based data security measures employed. If proprietary vendors are collecting the data, and if breach of confidentiality could put respondents at risk due to the nature of the survey, consent forms should spell out this possibility to potential respondents. If the vendor is not willing or able to provide this information, another vendor must be used.

1. 
   Secure File Share (aka; secure File Transfer Protocol or “FTP”). This service is available through the UAF Life Sciences Informatics (INBRE) and can be used to securely transmit data between collaborators, wherever located, as long as both parties have internet access. A researcher submits a request to INBRE once the share account is activated, it can be used to store and share research data, personal identifiers, and/or key files for de-identified data sets. A single researcher may also use this service to store and access their own research data from different locations; for example, home and office. In this way, no data is stored on personal computers or laptops.
   
2. 
   Virtual Private Network (VPN). VPNs are commercially available for nominal fees and in some cases these fees may be allowable grant charges.
   
3. 
   Email. The IRB prefers this method not be used to transfer data in favor of either a Secure File Share service or a VPN. If neither of those is available, email may only be used to transfer data if it is contained in an encrypted file attachment.
   
4. 
   Jump drives, CDs or DVDs. These may be used to transfer data provided the device utilizes encryption or password options above for the device. They may be hand-carried, stored in carry-on luggage (NOT checked baggage) or mailed via USPS certified mail, FedEx, or UPS. Package tracking must be used.
   

The following checklist can assist investigators in assessing their data security and protections and provide guidance on what to include in protocol narratives and consent forms.