Completing the Privacy and Confidentiality Section

The Privacy and Confidentiality section of the initial review application asks study team to describe how they will ensure subject privacy during study procedures and how they will protect data from unauthorized access or unintended breach of confidentiality. The latter includes how data, images, and/or samples will be protected during transfer outside UW-Madison, in the event that a study involves sharing any of these outside institutions.

When does the Privacy and Confidentiality section display?

The Research Design and Procedures section will display for the following application types: Full review, Exemption (all exemption types except "Not Research"), and Non-exempt medical records applications.

How should study teams answer question 1.1 in the Privacy and Confidentiality section?

Study teams should provide a concise overview of the precautions they will take to protect subjects' privacy during study procedures, such as concluding study procedures in a private clinic room. If study teams will not have contact with subjects during the study, e.g. for a retrospective medical records review, this should be clearly stated. The study team should also clarify whether the study team will collect sensitive information about subjects, and if so, confirm the collection of sensitive information about subjects is limited to the amount necessary to achieve the aims of the research. Please note that information about data confidentiality should not be addressed in this question.

How should study teams answer question 1.2 in the Privacy and Confidentiality section?

The response to this question depends on whether study data will be identifiable or not. Depending on the data to be collected and/or generated for the study, more than one choice may be appropriate.

How should study teams answer question 1.3 in the Privacy and Confidentiality section?

The response to this question should directly address how study data will be kept secure from breach of confidentiality. The response to this question should include the following information:

1. Specify the department and location where you will store study data and describe the data security measures you will employ to protect data from unauthorized access. Clarify whether data will be in hard-copy or electronic format, or both. Please note that hard copy data must be stored in a locked location (e.g. locked file cabinet) within a limited-access location (e.g. private office or lab with restricted access). Electronic data must be stored on a secure departmental server which is backed up according to a standard protocol. Alternatively, it may be stored in a secure program such as REDCap. If using REDCap, please specify the instance of REDCap the study team will use, e.g. the ICTR instance. If the study team will be making audio or video recordings of subjects’ participation in the study, please describe how these will be stored as well.
2. For studies that involve indirectly identifiable, i.e. coded data: Specify the department and location where you will store the file linking study codes to subject identifiers and describe the data security measures you will employ to protect the linking file from unauthorized access. Clarify whether the linking file will be in hard-copy or electronic format, or both. As above, please note that a hard-copy linking file must be stored in a locked location within a limited-access location. An electronic linking file must be stored on a secure departmental server, or, if coded data are stored in REDCap, a separate table may be used within REDCap to link study codes to subject identifiers.
3. State who will have access to coded study data and who will have access to subject identifiers.
4. Clarify whether data will be de-identified or destroyed at some point, and if so, when.

How should study teams answer questions 1.4 and 1.4.1 in the Privacy and Confidentiality section?

These should be checked “yes” if the study team will retain data from this study for future research purposes.

How should study teams answer questions 2.1 and 2.1.1 in the Privacy and Confidentiality: Continued section?

If the study team will store study data on portable devices such as laptops, notebooks, USB drives or external hard drives, the answer to Question 2.1 is "yes". (This does not apply if the study team will simply access data using a portable device such as a laptop, as long as the data are stored on a secure server or network rather than on the portable device itself.) In the response to question 2.1.1, the study team must describe how data will be protected from breach of confidentiality in the event of theft or loss of the portable device, e.g. only coded or de-identified data will be stored on the portable device. The HS IRBs office strongly recommends that study teams store only coded or de-identified data will be stored on the portable device. Please note that, according to UW-Madison School of Medicine and Public Health policy, subject identifiers cannot be stored on portable devices unless the devices are encrypted.

How should study teams answer question 2.2 in the Privacy and Confidentiality: Continued section?

If the study team will not share any data, images, or specimens from the study, the response should be “No.”

If the study team will share study data, images, or specimens AND the study is an industry-sponsored clinical trial OR a cooperative group study, the response should be “Not Applicable.” These are the only situations in which “Not Applicable” is appropriate. Please note that “cooperative group” specifically means a federal cooperative research group such as ECOG.

If the study team will share study data, images, or specimens outside UW-Madison and the study is neither an industry-sponsored clinical trial or a cooperative group study, the response should be “Yes.” Please note that publishing or presenting results of the completed study does not constitute sharing data in the context of this question, and by itself does not warrant a “Yes” response to this question.

How should study teams answer question 3.1 in the Release of Data, Images, or Specimens Outside the UW-Madison section?

This response depends on what will be sent outside the UW-Madison. More than one of the following may be selected:

How should study teams answer question 3.2 in the Release of Data, Images, or Specimens Outside the UW-Madison section?

This response should list all entities outside the UW-Madison with whom data will be shared. The list may include sponsors, funding agencies, research institutions, and/or individual researchers as applicable.

How should study teams answer question 3.3 in the Release of Data, Images, or Specimens Outside the UW-Madison section?

This response should specify any study codes, limited identifiers and/or any other data points that may serve as direct or indirect identifiers.

How should study teams answer question 3.4 in the Release of Data, Images, or Specimens Outside the UW-Madison section?

This response should include a detailed description of how data, images, and/or specimens will be transferred to the outside entities or individuals listed in the response to 3.2. For example, in the case of samples, the study teams must describe how they will send the samples, e.g. an overnight courier such as FedEx. In the case of data transfer, the study team must provide detailed information about how data will be transferred securely, e.g. by uploading to a dedicated website that uses secure FTP to transfer files. In this example, the study would also need to provide data security information about the website itself and state who maintains it. The response to 3.4 must also state whether subject identifiers will be transferred to the outside site(s). If the study team proposes to send coded data, images, or samples, the response must state who maintains the key to the study code.

How should study teams answer question 3.5 in the Release of Data, Images, or Specimens Outside the UW-Madison section?

This response should specify whether what is shared outside the UW-Madison will be returned or not. For example, samples are often exhausted in the process of analysis at the outside site, but if they are not, they are often returned.

How should study teams answer question 3.6 in the Release of Data, Images, or Specimens Outside the UW-Madison section?

This response should clarify the reason for sharing the samples with an outside entity or individual. For example, the entity or individual may be able to conduct analyses of tissue samples that are not currently available at UW-Madison.