Completing the Privacy and Confidentiality Section
How to complete the privacy and confidentiality section
What is the purpose of the Privacy and Confidentiality section? The Privacy and Confidentiality section of the initial review application asks study team to describe how they will ensure subject privacy during study procedures and how they will protect data from unauthorized access or unintended breach of confidentiality. The latter includes how data, images, and/or samples will be protected during transfer outside UW-Madison, in the event that a study involves sharing any of these outside institutions. When does the Privacy and Confidentiality section display? The Research Design and Procedures section will display for the following application types: Full review, Exemption (all exemption types except "Not Research"), and Non-exempt medical records applications. How should study teams answer question 1.1 in the Privacy and Confidentiality section? Study teams should provide a concise overview of the precautions they will take to protect subjects' privacy during study procedures, such as concluding study procedures in a private clinic room. If study teams will not have contact with subjects during the study, e.g. for a retrospective medical records review, this should be clearly stated. The study team should also clarify whether the study team will collect sensitive information about subjects, and if so, confirm the collection of sensitive information about subjects is limited to the amount necessary to achieve the aims of the research. Please note that information about data confidentiality should not be addressed in this question. How should study teams answer question 1.2 in the Privacy and Confidentiality section? The response to this question depends on whether study data will be identifiable or not. Depending on the data to be collected and/or generated for the study, more than one choice may be appropriate. How should study teams answer question 1.3 in the Privacy and Confidentiality section? The response to this question should directly address how study data will be kept secure from breach of confidentiality. The response to this question should include the following information:
How should study teams answer questions 1.4 and 1.4.1 in the Privacy and Confidentiality section? These should be checked “yes” if the study team will retain data from this study for future research purposes. How should study teams answer questions 2.1 and 2.1.1 in the Privacy and Confidentiality: Continued section? If the study team will store study data on portable devices such as laptops, notebooks, USB drives or external hard drives, the answer to Question 2.1 is "yes". (This does not apply if the study team will simply access data using a portable device such as a laptop, as long as the data are stored on a secure server or network rather than on the portable device itself.) In the response to question 2.1.1, the study team must describe how data will be protected from breach of confidentiality in the event of theft or loss of the portable device, e.g. only coded or de-identified data will be stored on the portable device. The HS IRBs office strongly recommends that study teams store only coded or de-identified data will be stored on the portable device. Please note that, according to UW-Madison School of Medicine and Public Health policy, subject identifiers cannot be stored on portable devices unless the devices are encrypted. How should study teams answer question 2.2 in the Privacy and Confidentiality: Continued section? If the study team will not share any data, images, or specimens from the study, the response should be “No.” If the study team will share study data, images, or specimens AND the study is an industry-sponsored clinical trial OR a cooperative group study, the response should be “Not Applicable.” These are the only situations in which “Not Applicable” is appropriate. Please note that “cooperative group” specifically means a federal cooperative research group such as ECOG. If the study team will share study data, images, or specimens outside UW-Madison and the study is neither an industry-sponsored clinical trial or a cooperative group study, the response should be “Yes.” Please note that publishing or presenting results of the completed study does not constitute sharing data in the context of this question, and by itself does not warrant a “Yes” response to this question. How should study teams answer question 3.1 in the Release of Data, Images, or Specimens Outside the UW-Madison section? This response depends on what will be sent outside the UW-Madison. More than one of the following may be selected: How should study teams answer question 3.2 in the Release of Data, Images, or Specimens Outside the UW-Madison section? This response should list all entities outside the UW-Madison with whom data will be shared. The list may include sponsors, funding agencies, research institutions, and/or individual researchers as applicable. How should study teams answer question 3.3 in the Release of Data, Images, or Specimens Outside the UW-Madison section? This response should specify any study codes, limited identifiers and/or any other data points that may serve as direct or indirect identifiers. How should study teams answer question 3.4 in the Release of Data, Images, or Specimens Outside the UW-Madison section? This response should include a detailed description of how data, images, and/or specimens will be transferred to the outside entities or individuals listed in the response to 3.2. For example, in the case of samples, the study teams must describe how they will send the samples, e.g. an overnight courier such as FedEx. In the case of data transfer, the study team must provide detailed information about how data will be transferred securely, e.g. by uploading to a dedicated website that uses secure FTP to transfer files. In this example, the study would also need to provide data security information about the website itself and state who maintains it. The response to 3.4 must also state whether subject identifiers will be transferred to the outside site(s). If the study team proposes to send coded data, images, or samples, the response must state who maintains the key to the study code. How should study teams answer question 3.5 in the Release of Data, Images, or Specimens Outside the UW-Madison section? This response should specify whether what is shared outside the UW-Madison will be returned or not. For example, samples are often exhausted in the process of analysis at the outside site, but if they are not, they are often returned. How should study teams answer question 3.6 in the Release of Data, Images, or Specimens Outside the UW-Madison section? This response should clarify the reason for sharing the samples with an outside entity or individual. For example, the entity or individual may be able to conduct analyses of tissue samples that are not currently available at UW-Madison.
Directly: Information identifying subjects is stored directly on data records
If
direct identifiers (e.g. name, medical record number, full address) will be stored in the study data set, then this option should be selected.
Indirectly: Information identifying subjects is linked to data record but stored separately
If
the study data set will be linked to direct identifiers via a study ID or code,
then this option should be selected. The usual method for linking study data
and identifiers is a separate file that includes the study ID or code and one
or more direct identifiers.
Anonymous: No direct or indirect links on data record
This
method may be selected only if the study data set does not include direct
identifiers AND is also not linked to identifiers via a study ID or code.
Data
Check
this option if data of any kind will be shared with an entity or individual outside
the UW-Madison. This includes de-identified, coded, and/or limited data sets. Sharing
of identifiable data is typically not allowed, unless consent and authorization
is obtained directly from subjects. Sharing of study results in the form of
publications or presentations does not need to be reported on this page.
Images
Check
this option if images of any kind (e.g. MRI, CT, ultrasound) will be shared
with an entity or individual outside the UW-Madison. Images should not be
identifiable, unless subjects have specifically consented to this;
de-identified or coded are acceptable. Please note that this option does not
apply to data derived from imaging, but rather to images themselves. If the
study team will share data derived from imaging, the “Data” option should be
checked.
Specimens
Check
this option if specimens of human-derived tissue or fluid (e.g. tumor tissue,
blood, cerebrospinal fluid) will be shared with an entity or individual outside
the UW-Madison. Specimens should not be identifiable unless subjects have
specifically consented to this; de-identified or coded are acceptable.