General Principles

Researchers should adhere to the HIPAA “minimum necessary” standard when using the protected health information (PHI) of potential research participants.  In cases when information regarding participant declinations or screen failures is not necessary, it should not be recorded.  However, this information is often needed to comply with IRB-approved recruitment plans or study sponsor requests.  In these instances, this guideline lays out the approved methods of recording and storing this information.

When a study sponsor requests information on unenrolled individuals, they should receive fully de-identified information. If the sponsor requests PHI (including a limited dataset of PHI), researchers must:

• have a basis in the HIPAA regulations for sharing this PHI (e.g. a data use agreement, a waiver of authorization, or infrequently a business associate agreement)
• AND only share the minimum necessary amount of PHI the sponsor needs for their workflows.

In these instances, this guideline lays out the approved methods of recording and storing this information.

UW-Madison and UW Health prefer that participant declinations or screen failures be stored in Health Link for several reasons:

1. It is a HIPAA-compliant systems with well-established access controls
2. It provides discrete fields that allow for easy recording and tracking of participant statuses, as well as comments related to that status.  See Prescreen Research Study Association Statuses in Health Link on The Pulse for more information (login required).
3. The data in Health Link can be queried by the SMPH Recruitment Core and used to track the success rate of different recruitment methods.  This allows for the development of targeted recruitment plans for individual studies.

In instances where tracking declinations and screen failures in Health Link is not feasible, the following HIPAA-compliant systems may be considered:

• REDCap¹
• Florence eBinders²
• File on SecureBox

PHI should never be stored outside of a HIPAA-compliant system.  For HIPAA-compliant systems, please see UW-Madison/SMPH Storage Options.

Instructions

*If you need information related to potential participant responses to MyChart Research Recruitment Invitations, please contact the SMPH Recruitment Core.

Special Circumstances

If a study involves the sharing of participant declinations or screen failures internationally, please work with SMPH Cybersecurity to determine appropriate data storage.  SMPH Cybersecurity can be reached at the SMPH Cybersecurity Portal.

1. UW-Madison has several instances of REDCap, one of which is FDA Title 21 CFR Part 11 compliant.  For details on available REDCap instances, please visit the REDCap: Overview.
2. Florence eBinders is another FDA Title 21 CFR Part 11 compliant system.