Each research unit/department is responsible for protecting all forms of PHI through proper HIPPA training, limiting access, reporting unauthorized access, maintaining a secure work environment, establishing routine back-ups, as well as following retention and destruction policy and procedures.

Do you know your Departmental IT contact? Do you know your HIPPA Privacy and Security Coordinator?

It is highly recommended that you work closely with your departmental IT, and regulatory specialists in your unit to ensure policies and procedures are in place, followed, and are in compliance with university and funding agencies. Ensure the following prior to using Lab Archives for restricted data.

1. Data retention and disposal plan
   1. Removal and disposal of ePHI on devices
2. End-point encryption, workstation management, and other configurations
3. Ensure third-party integrations are approved for restricted data
   1. HIPPA approved list
   2. Record of third-party integrations used within notebook
4. Formal security plan
5. Proper asset management
6. Properly handling ePHI and maintaining safe and secure workstations
7. Record of HIPPA training and compliance
8. Security contingency plan
   1. Routine secure backups
   2. Recommendation: restricted research drive
9. Security incident reporting
10. Securely sharing/transferring data (if applicable)

Do you know WHO has access to your restricted data notebook(s)?

Requesting Access

Receiving access to Lab Archives is a 2-step process.

1. Request Access through university.
2. Sign in to LabArchives by selecting your institution and using university SSO (single sign on) credentials.
   1. Net ID and Password
   2. You (the notebook owner) must share notebook and update permissions within Lab Archives to allow others to edit.
   3. Within a notebook, you can update the roles and privileges of each collaborator.

Requesting a new restricted data lab

1. Complete a request form on the UW Madison ELN website.
2. Indicate lab DOES NOT currently use the electronic notebook.
   1. Fill out lab information and associated user access request.
3. Indicate data classification as restricted.

Requesting new users to restricted data lab

1. Complete a request form on the UW Madison ELN website.
2. Users will have permissions to edit existing notebooks shared with them (owned by PI) but cannot create notebooks themselves.
3. PIs are advised to review access on a routine basis (i.e. semesterly).

Access to external [non-uw madison] collaborators

1. LabArchives allows notebook owners to share their research with those who are not part of UW-Madison using the Guest access role.
2. Though Lab Archives provides this feature, users are cautioned against sharing notebooks containing PHI in this way.
3.  If a guest user does not have a Net ID, the University has no way of linking an identity to the email address
4. If no action is done to change permissions, guests lose write access after 60 days of sharing due to the licensing agreement with LabArchives. After 60 days, access becomes Read Only until permissions are changed.
5. External collaborators can instead request a NetID.
6. If research must be shared with non-UW collaborators, PIs should ensure guests are trusted collaborators and may require a Data Transfer Use Agreement (DTUA), as they will have the ability to download data from the notebook and potentially to make changes to the content of the notebook depending on the permissions granted.
7. PIs are advised to review guest access on a routine basis (i.e. monthly).

Reviewing Access

Research Unit

You are encouraged to review all access, especially guest access on a routine basis.

ELN Service Team

1. Users' access to the LabArchives system will be audited at the beginning of each semester.
2.  You will receive an email message from the LabArchives site administrator with individuals associated with your lab group.
3. You will be asked to verify that identified users are still associated with your labs. You can also identify new lab members or request removal at this time.

Removing Access

1. You are responsible for requesting the removal of users from Lab Archive Access by asking a question on the ELN website as well as updating notebook Sharing Permissions settings.

Do you know WHAT is happening in your notebook(s)?

UW Madison the Lab Archives site is specifically set to block deletion of notebooks and entries. Rather, when removed from view, the notebook and/or entry is moved to an archived folder. Additionally, within a notebook, a date-time and user credentials are stamped to each entry when last edited.

1. The Activity Feed provides an audit trail of every action that has occurred within a notebook.  It does not track sign-in or offline content export.
2. The Activity feed is only seen by the notebook owner and shared collaborators. The service team does not have access to this detailed feed of changes and therefore it is the PI’s responsibility.  
3. PIs are advised to routinely review user access and the activity feeds of the research notebooks they own on a routine basis (i.e. weekly).
   1. SOPs can be found on the Lab Archives in Group Management and Activity Feed pages. 

Do you know WHERE to find the research you need?

The university has several resources on campus to help you develop and use good data management practices within your research and notebooks. Think about the following while starting your ELN.

1. Folder and file structure
2. Read-Me files
3. Naming conventions
4. Notebook Settings – Newest content on top or bottom?
5. Metadata (especially associated with attachments)
6. And more

There are resources on campus to help!

1. Tools:
   1. DMPTool (data management plans)
   2. Data Storage Finder
   3. Researcher Toolkit
   4. MINDS@UW
2. Groups:
   1. Research Data Services 
   2. Research Cyberinfrastructure
   3. Data Science Hub 
   4. UW-Madison Libraries
   5. Center for High Throughput Computing (CHTC) 

 Finally, the ELN Service Team is here to help you. Email eln@doit.wisc.edu or ask a question at any time. 

1. Adding new service-level user access
2. Onboarding and Training
3. Questions and Consultations
4. Removing service-level user access
5. Requesting a service-level new research lab
6. Security Incident Reporting