Data Security in Human Subjects Research
Purpose
The purpose of this guidance is to provide general considerations for managing data security in human subjects research reviewed and approved by the Charles River Campus IRB.
Data Security Requirements
University Data is information generated by, owned by, or otherwise in the possession of Boston University that is related to the University’s activities, including research data. University Research data is subject to BU’s Data Protection Standards. Under the University’s Data Classification Policy, data are categorized as Public, Internal, Confidential or Restricted Use with varying standards for protection that must be applied.
Researcher Responsibilities
- Researchers who collect or utilize research data are responsible for accessing, storing, transferring and processing data on systems that have appropriate security measures for the classification of data being used.
- Researchers should itemize the kinds of data being collected and/or utilized as part of their research and determine what level of security is needed for their data.
- Researchers should consult with IS&T and/or their local IT support groups to determine the best way to access, store, and use their data, particularly for data categorized as confidential or restricted use.
Examples of Research Data and Corresponding BU Data Classification
- While most research data at BU are not subject to the HIPAA Privacy Rule, the HIPAA de-identification standard (removal of 18 data elements – e.g. email addresses, phone numbers, birth dates, zip codes, etc.) is still the gold standard. When data are deidentified in in the manner of the HIPAA Privacy Rule, there are no specific requirements for platform-use at BU, as the data are categorized as Public.
- Similarly under the HIPAA Privacy Rule are data that are considered Limited Data Sets, meaning, they contain protected health information* that excludes direct identifiers, effectively anonymizing data by limiting the elements to dates, cities and zip codes. When BU data are anonymized in the manner of the HIPAA Limited Data Set standard, the BU Shared Computing Cluster, BU Office 365 applications, BU REDCap or Qualtrics, BU Network Drives (NAS1), BU Google apps and others may be used, as these data are categorized as Confidential. NOTE: BU Google apps cannot be used for Limited Data Sets under HIPAA, as the data are typically provided by HIPAA Covered Entities, such as hospitals, health clinics, health insurers, the MA Department of Public Health, etc. Limited Data Sets from HIPAA Covered Entities require the execution of data use agreements (DUAs). For more information on DUAs, please contact BU’s Office of Industry Engagement.
- The research is health-related* and includes some personally identifiable information such as email addresses, phone numbers, facial images in pictures/videos (even if there is no name associated with the image), etc. In this case, BU Restricted Use network drive (nas-RU1 or BUMC Y Drive); BU Office365 apps, such as SharePoint, OneDrive, Teams; BU REDCap or Qualtrics and others may be used, as this data is categorized as Restricted Use. Note, however, that if the research is not health-related (e.g., amount of texts sent/day) it is classified as Confidential even when identifiable information is included.
Considerations for IRB Applications
As part of the IRB’s role in protecting the rights and welfare of human subjects, researchers must identify which electronic platforms, data transfer methods, data/document storage plans, etc. are being proposed in the research. This information can be documented in the Confidentiality of Data section of the IRB application. BU’s InfoSec has provided sample language that can be used in the Confidentiality of Data section of the IRB application.
Researchers are encouraged to consult with IS&T on the use of third-party data collection, storage or analysis applications proposed for their research. Providing the IRB with correspondence with BU IS&T verifying the appropriateness of novel or third-party applications can facilitate the IRB’s review of the Confidentiality of Data plan.
FAQs, Answered By BU’s Information Security
Data Storage & Security Questions
I have completed my research study and need to save the data for 7 years. How do I do this?
I want to store my data on a password-protected computer that will be stored in a locked office, but someone mentioned BU requires encryption as well. Is that true?
Data Transfer & Communications Questions
As part of my field research, I am recording interviews using my cell phone and uploading to the BU networked shared drive. However, my collaborators do not have access to the BU networked shared drive and wish to text me audio recordings of interviews they have collected. Is there a better way to handle this?
What platforms can I use to share health-related* information?
What platforms can I use to send appointment updates with no disclosure of health-related information?
Consent Participants Remotely
I would like to use Google Forms to consent participants. Is that OK?
Additional Resources
- BU IS&T offers a wide range of services to ensure the security of Boston University’s information and technology resources. Researchers are encouraged to consult with IS&T
- BU InfoSec for Researchers page provides a list of BU-reviewed and cleared services based on Data Classification
- Data Storage Options offered by IS&T
- BU HIPAA Policy outlines how covered components must protect HIPAA data
- Email best practices security reminder
*Health-related information is very broad, including stress or anxiety related to school, but does not typically include social engagement, decision making, number of texts sent per day, or educational practices, strategies, or effectiveness.