Guide to Data Management and Protection

!!!!!!GUIDE!TO!DATA!MANAGEMENT!AND!PROTECTION !

415 South Street, MS 116 • Bernstein-Marcus, Room 121 • Waltham, MA 02454 • T: 781.736.8133 • F: 781 736 2123 • hrpp-group@brandeis.edu

The!risk!of!harm!resulting!from!a!breach!of!confidentiality!varies!with!the!level!of!sensitivity!of!the!research!data.!Th e!ch a rt!

below!outlines!the!risk!levels!associated!with!different!types!of!research!data,!a n d !is !fo l lo wed!by!op tions!for!the !

management!of!research!data!at!each!risk!level.!!

DEFINITIONS!

Anonymous!Data:!Data!collected!and!recorded!such!that!no!identifier!whatsoever!exists!to!link!a!subject’s!identity!to!that!

subject’s!response!

Coded!Data:!Data!where !id e n tify in g !in fo rmation!ha s!b e e n !re p la c ed !with!a!cod e!a n d !a !k e y!t o !d ec ip h e r!th e !c o d e !is!a v a ilab le ,!

which!can!link!the!identifying!information!to!the!data!

Confidential!Data:!Data!that!a!subject!has!disclosed!to!the!investigator!with!the!expectation!that!it!will!not!be!divulged!to!

others!without!the!subject’s!permission!

De-identifie d !D a t a:!Data!from !w h ic h !a ll!p e rso nally!identifiable!information!has!been!severed!

Greater!than!Minimal!Risk!Data:!Data!the!disclosu re !o f!which!cou ld !ca u s e !greater!than!minimal!harm!or!distress!(such!as!

that!not!encountere d!in!da ily!life!or!during !the!pe rform an ce!o f!routine !phy sicals!or!psychological!examinations!or!tests).!

Minimal!Risk!Data:!Data!the!disc lo su r e!of!which!w o u ld !c a u se !minimal!ha rm!or!distres s!( su c h !a s!t h a t!e n co untered!in!daily!life!

or!during!the!performance!of!routine!physicals!or!psychological!examinations!or!tests).!!

Research!Data:!Human!subjects’!data,!documentation!of!subject!eligibility,!original!signed!and!dated!consent!forms!(or!

record!of!consen t!if!verba l),!ma ster!key s,!and !find ing s!review !log s,!as!we ll!as!an cillary!m ate rials!su ch!a s!ad m inistra tive!an d!

financial!recor d s.!

Sensitive!Data:!Data!the!dis c lo su re !o f!which!cou ld !have!adverse!consequences!or!put!a!subject!at!risk!of!criminal!or!civil!

liability!or!be !d a m a g in g!to !h is /h e r!finan cial!sta nd in g,!em p loy ab ility,!repu ta tion ,!etc.!

RISK!LEVELS!

Level!I!

Publicly!Available!Data!

Anonymous!Data!

Non-confidential!Data!

De-identified !M in imal!Risk!Co n fid en t ial!Data!

Level!II!

Coded!Minimal!Risk!Confidential!Data!

De-identified !G rea te r!th a n !Minimal!Ris k!C o n fid e n tia l!D a ta!

Level!III!

Identifiable !Minimal!R isk !C o n fid e n tia l!D a ta !

Coded!Greater!than!Minimal!Risk!Confidential!Data!

De-identified !Se n sitiv e !C on f id en tia l!D a ta !

Level!IV!

Identifiable !G r ea te r!t h an !Minimal!R isk !C o n fid e n tia l!D a ta !

Coded!Sensitive!Confidential!Data!

Level!V!

Identifiable !S e n sit ive !C o n fid e n tia l!D a ta !

DATA!MANAGEMENT!AND!PROTECTION!

GENERAL!CONSIDERATIONS!FOR!ALL!RISK!LEVELS!

1. The!most!restrictive!management!option!feasible!should!be!employed.

2. Only!the!minimum!subject!identifiers!–!direct!and!indirect!–!necessary!for!the!research!should!be!collected.

3. When!working!with!sensitive!data,!subject!identifiers!should!be!removed!or!destroyed!as!soon!as!is!feasible!for!th

research.

Note!that!research!data!are!not!considered!de-identified!unle ss !A LL !link s!b e tw e en !th e !su b jec t’s!id e nt ity!a n d !th eir!d a ta

are!destroyed.

4. Physical!and/or!electronic!access!to!any!area!and/or!device!where!research!data!are!being!stored!must!be!limited.

5. Access!to!all!confidential!identifiable!sensitive!researc h!d ata!sho uld!be!limited!to!investigators!and!key!researc

personnel.

Note!that!for!student!researchers,!this!must!include!the!PI.

6. Strong!passwords!must!always!be!used.

See!Brandeis!University!ITS’s!webpage!Protect!Your!Data!and!Identity!for!information!rega rdin g!cre atin g!stro ng

passwords.

7. Only!secure/encrypted!modes!of!electronic!transmission!of!research!data!should!be!used.

Note!that!email!and!text!transmissions!are!generally!not!secure!and!should!not!be!used!to!transmit!research!data.

8. Computers!must!be!protected!against!malware!with!anti-malware!software!approved!by!the!Brandeis!University!ITS,

and!all!software!updates!and!patches!applied.

9. The!PI!must!report!any!breaches!in!confidentiality!to!the!IRB!within!seven!days!of!the!researchers!becoming!aware!of

the!event.

10. Brandeis!University!policy!holds!that!human-subjects!research!data !mu st!b e!retain ed !for!a!minimum!of!three!years.

Note!that!a!number!of!policies,!guidelines,!rules,!and!regulations!require!longer!retention!of!research!data.!See!HRPP

Policy!#101:!Data!Retention!for!additional!info rm a tion .

11. When!destroying!research!data!stored!on!a!computer,!deleting!the!files!is!not!enough!as!the!deleted!files!can!still!be

recovered.!The!de leted !files!m ust!a lso!b e!scrub bed!from!the!com p ute r!so !tha t!the !da ta!are !pe rm a ne ntly !eras ed .!Th is

may!be!done!using!commercial!software!approved!by!the!Brandeis!University!ITS.!Alternatively,!the!device!may!be

degaussed!or!destroyed.

12. If!keeping!sen sitive!resea rch !data !ind efin itely,!data !sho u ld!be !de-identified,!at!the!latest,!when!the!current!project!is

complete.

13. If!retaining!d e -identified!res ea rc h !d at a!in d e fin ite ly,!s to ra ge !in !a !d ata !re p o sit or y!s h o u ld!b e !c o n sid er ed .

14. If!conduc tin g !an !o n lin e !s u rv ey ,!th e !B ra n d e is!University!pr ef er en c e !a n d !d ef au lt !is!th a t!in v e st iga to rs !u s e!Qualtrics.

Note!that!Qualtrics!gives!the!option!for!anonymization!of!research!data,!and!can!be!set!so!that!IP!addresses!(considered

identifiers)!are !not!collected.

Note!that!students!will!no!longer!have!access!to!their!Qualtrics!accounts!once!they!leave!Brandeis!University;!therefore,

student!researchers!should!use!their!PI’s!Qualtrics!account!and!utilize!the!collaboration!feature!to!develop!their!online

surveys.

DATA!MANAGEMENT!AND!PROTECTION!

Note!that!Amazon’s!Mechanical!Turk!(MTurk)!should!be!used!as!a!recruitment!tool!only;!Amazon!has!access!to!subjects’!

identifiers!an d !su rve y !res p on se s!when!survey s!a re !ru n !int ern a lly !to!MTurk,!making!co n f id e n ti a lit y!an!impos s ib ili ty .!

Instead,!a !lin k!t o !a !Q u a ltric s !su rv e y!c a n !b e !embedded !in !th e !MTurk!desc rip tio n !o f !th e!s tu d y .!!

15. If!traveling!a b ro a d ,!in te rn a tio n a l!laws!and!ex p o rt!c o n tro ls !re gu la tio n s !must!be!co n sid e re d !a s!t h ey !may!limit!the

movement!of!research!data!out!of!the!country,!both!physically!and!electronically.!The!principal!investigator!must!know

the!applicable!laws!and !regu lation s!of!the!co un try!in!w hich !the!resea rch!w ill!be!con du cted !befo re!em ba rking !on!an y

research!and,!if!need ed ,!arran gements!and!agreements!must!be!in!p lace !to!ens ure !com p lian ce.

Note!that!if!conducting!research!in!a!European!Union!or!other!European!Economic!Area!state,!the!data!may!be!subject!t

the!General!Data !Prote ction!R egu lation s!(G DP R),!w hich !ma y!incre ase !the !le ve l!o f!d at a!p ro te ct ion !re q uir ed .!C o n tac t!th e

HRPP!office!for!more!information.

15. As!research!progresses,!so!might!the!risk!level!–!appropriate!data!management!must!be!used!for!the!level!of!risk!at!each

stage!of!the!research.

DATA!MANAGEMENT!OPTIONS:!RISK!LEVEL!I!

When!Working!with!Paper!Documents!!

Paper!documents!such!as!surveys,!audio!transcriptions,!or!field!notes!must!be!stored!in!a!secure!place!such!as!a!locked!file!

cabinet.!!

Note:!Any!signed!consent!forms!must!be!stored!in!a!separate!locked!cabinet!from!the!remaining!research!data.!

When!Working!with!Digital!Recordings!

Digital!recording!devices/audiotapes/videotapes!with!recordings!of!interviews,!field!notes,!etc.!must!be!stored!in!a!secure!

place!such!as!a!locked!file!cabinet.!

Note:!You!can!audio!record!directly!into!your!Box.com!account,!eliminating!the!need!for!transporting!and !storing!audio!

recording!devices/a ud iota pes .!

When!Using!Electronic!Storage!

When!scanned!or!uploaded,!paper!documents!and!audio/video!files!must!be!stored!in!one!of!the!following:!

• Brandeis-provided!Box.com!account

• Brandeis-provided!and!Brandeis-certified!file!server

• Password!protected!computer!file

When!Working!with!Digital!System!Files!

Digital!system!files!such!as!d ata ba se s,!SAS /S PS S!d ata !files,!or!cu stom!application!rec ord !sets !m us t!be !store d!in !on e!o f!the !

following:!

• Brandeis-provided!Box.com!account

• Brandeis-provided!and!Brandeis-certified!file!server

• Password!protected!computer!file

DATA!MANAGEMENT!OPTIONS:!RISK!LEVEL!II!

When!Working!with!Paper!Documents!

Paper!documents!such!as!surveys,!audio!transcriptions,!or!field!notes!must!be!stored!in!a!secure!place!such!as!a!locked!file!

cabinet!in!a!locked!office.!!

Note:!Any!signed!consent!forms!and!master!keys!must!be!stored!in!a!separate!locked!cabinet!from!the!remaining!research!

data.!!

When!Working!with!Digital!Recordings!

Digital!recording!devices/audiotapes/videotapes!with!recordings!of!interviews,!field!notes,!etc.!must!be!stored!in!a!secure!

place!such!as!a!locked!file!cabinet!in!a!locked!office.!

DATA!MANAGEMENT!AND!PROTECTION!

Note:!You!can!audio!record!directly!into!your!Box.com!account,!eliminating!the!need!for!transporting !and !storing!aud io!

recording!devices/a ud iota pes .!

When!Using!Electronic!Storage!

When!scanned!or!uploaded,!paper!documents!and!audio/video!files!must!be!stored!in!one!of!the!following:!

• Brandeis-provided!Box.com!account

• Brandeis-provided!and!Brandeis-certified!file!server

• Password!protected!computer!file

Note:!When!consent!forms!and!master!keys!are!stored!digitally,!they!must!be!stored!in!separate!accounts!from!the!research!

data.!

When!Working!with!Digital!System!Files!

Digital!system!files!such!as!databases,!SAS/SPSS!data!files,!or!custom!application!record!sets!must!be!stored!in!one!of!the!

following:!

• Brandeis-provided!Box.com!account

• Brandeis-provided!and!Brandeis-certified!file!server

• Password!protected!computer!file

Review!of!Findings!

The!safety!of!all!research!data!should!be!reviewed!and!the!findings!logged!on!a!regular!basis.!

DATA!MANAGEMENT!OPTIONS:!RISK!LEVEL!III!

When!Working!with!Paper!Documents!

Paper!documents!such!as!surveys,!audio!transcriptions,!or!field!notes!must!be!stored!in!a!secure!place!such!as!a!locked!file!

cabinet!in!a!locked!office.!!

Note:!Any!signed!consent!forms!and!master!keys!must!be!stored!in!a!separate!locked!cabinet!from!the!remaining!research!

data.!!

Any!master!keys!should!be!shredded!as!early!as!is!feasible.!

When!Working!with!Digital!Recordings!

Digital!recording!devices/audiotapes/videotapes!with!recordings!of!interviews,!field!notes,!etc.!must!be!stored!in!a!secure!

place!such!as!a!locked!file!cabinet!in!a!locked!office.!

Note:!You!can!audio!record!directly!into!your!Box.com!account,!eliminating!the!need!for!transporting!and!storing!audio!

recording!devices/a ud iota pes .!

When!Using!Electronic!Storage!

When!scanned!or!uploaded,!paper!documents!and!audio/video!files!must!be!stored!in!one!of!the!following:!

• Brandeis-provided!Box.com!account

• Brandeis-provided!and!Brandeis-certified!file!server

• Password!protected!and!encrypted!computer!file

Note:!When!consent!forms!and!master!keys!are!stored!digitally,!they!must!be!stored!in!separate!accounts!from!the!research!

data.!

When!Working!with!Digital!System!Files!

Digital!system!files!such!as!databases,!SAS/SPSS!data!files,!or!custom!application!record!sets!must!be!stored!in!one!of!the!

following:!

• Brandeis-provided!Box.com!account

• Brandeis-provided!and!Brandeis-certified!file!server

• Password!protected!and!encrypted!computer!file

DATA!MANAGEMENT!AND!PROTECTION!

Review!of!Findings!

The!safety!of!all!research!data!should!be!reviewed!and!the!findings!logged,!at!a!minimum,!on!a!weekly!basis.!

DATA!MANAGEMENT!OPTIONS:!RISK!LEVEL!IV!

When!Working!with!Paper!Documents!!

Paper!documents!such!as!surveys,!audio!transcriptions,!or!field!notes!must!be!stored!in!a!secure!place!such!as!a!locked!box!

in!a!locked !file !ca b in e t!in !a !loc k ed !o ff ice ,!or !a!lo c k ed !file !ca b in e t!in !a !lo ck ed !o f fice !w ith !e le ct ro n ic!d o o r!a c ce ss !co n tr o l!and/or!

in!sight!of!a !se cu rity !c amera.!!

When!being!transported,!paper!documents!must!be!secured,!for!example!in!a!locked!briefcase!or!lockbox.!

Note:!Any!signed!consent!forms!and!master!keys!must!be!stored!in!a!separate!locked!cabinet!from!the!remaining!research!

data!–!preferably!in!a!separate!room!or!building.!!

Paper!documents!should!be!scanned!and!shredded!as!early!as!is!feasible.!

When!Working!with!Digital!Recordings!

Digital!recording!devices/audiotapes/videotapes!with!recordings!of!interviews,!field!notes,!etc.!must!be!stored!in!a!secure!

place!such!as!a!locked!box!in!a!locked!file!cabinet!in!a!locked!office,!or!a!locked!file!cabinet!in!a!locked!office!with!electronic!

door!access!control!and/or!in!sight!of!a!security!camera.!

When!being!transported,!digital!recording!devices/audiotapes/videotapes!must!be!secured,!for!example!in!a!locked!

briefcase!or!lockbox.!

Note:!You!can!audio!record!directly!into!your!Box.co m !a c co u n t,!eliminating!the !n ee d!f or !tra n sp or tin g!a n d !sto rin g !a ud io !

recording!devices/a ud iota pes .!

Audio/video!files!should!be!uploaded!and!originals!destroyed!as!early!as!is!feasible.!

When!Using!Electronic!Storage!

When!scanned!or!uploaded,!paper!documents!and!audio/video!files!must!be!stored!in!one!of!the!following:!

• Brandeis-provided!Box.com!account

• Brandeis-provided!and!Brandeis-certified!file!server

If!access!to !th e !in te rn e t!is !n o t!p o ss ib le ,!u se !o f!a !p a s sword!prote c te d!and!encrypted!USB!drive!or!anti-virus!protected,!

password!protected,!and!encrypted!computer!file!may!be!allowable.!The!device!(e.g.,!computer!or!USB!drive)!should!be!

stored!in!a!locked!box!in!a!locked!file!cabinet!in!a!locked!office,!or!a!locked!file!cabinet!in!a!locked!office!with!electronic!door!

access!control!and/or!in!sight!of!a!security!camera.!

Note:!When!consent!forms!and!master!keys!are!stored!digitally,!they!must!be!stored!in!separate!accounts!from!the!research!

data.!

When!Working!with!Digital!System!Files!

Digital!system!files!such!as!databases,!SAS/SPSS!data!files,!or!custom!application!record!sets!must!be!stored!in!one!of!the!

following:!

• Brandeis-provided!Box.com!account

• Brandeis-provided!and!Brandeis-certified!file!server

• Password!protected!and!encrypted!computer!file

Review!of!Findings!

The!safety!of!all!research!data!should!be!reviewed!and!the!findings!logged!on!a!daily!basis.!

DATA!MANAGEMENT!OPTIONS:!RISK!LEVEL!V!

Note!that!paper!documents,!audiotapes,!and!videotapes!should!be!avoided!–!and!researc h!data!collected!electronically!–!

whenever!possible.!

DATA!MANAGEMENT!AND!PROTECTION!

When!Working!with!Paper!Documents!!

Paper!documents!such!as!surveys,!audio!transcriptions,!or!field!notes!must!be!stored!in!a!secure!place!such!as!a!locked!box!

in!a!locked !file !ca b in e t!in !a !loc k ed !o ff ice ,!or!a!locked!file!cabinet!in!a!locked!office!with!electronic!door!access!control!and/or!

in!sight!of!a !se cu rity !c amera.!!

When!being!transported,!paper!documents!must!be!secured,!for!example!in!a!locked!briefcase!or!lockbox.!

Paper!documents!should!be!scanned!and!shredded!as!early!as!is!feasible.!

When!Working!with!Digital!Recordings!

Digital!recording!devices/audiotapes/videotapes!with!recordings!of!interviews,!field!notes,!etc.!must!be!stored!in!a!secure!

place!such!as!a!locked!box!in!a!locked!file!cabinet!in!a!locked!office,!or!a!locked!file!cabinet!in!a!locked!office!with!electronic!

door!access!control!and/or!in!sight!of!a!security!camera.!

When!being!transported,!digital!recordings!must!be!secured,!for!example!in!a!locked!briefcase!or!lockbox.!

Note:!You!can!audio!record!directly!into!your!Box.com!account,!eliminating!the!need!for!transporting!and!storing!audio!

recording!devices/a ud iota pes .!

Audio/video!files!should!be!uploaded!and!destroyed!as!early!as!is!feasible.!

When!Using!Electronic!Storage!

When!scanned!or!uploaded,!paper!documents!and!aud io/video!files!must!be!stored!in!one!of!the!following:!

• Brandeis-provided!Box.com!account

• Brandeis-provided!and!Brandeis-certified!file!server

If!access!to !th e !in te rn e t!is !n o t!p o ss ib le ,!u se !o f!a !p a s sword!prote c ted!and!encrypted!USB!drive!or!anti-virus!protected,!

password!protected,!and!encrypted!computer!file!may!be!allowable.!The!device!(e.g.,!computer!or!USB!drive)!should!be!

stored!in!a!locked!box!in!a!locked!file!cabinet!in!a!locked!office,!or!a!locked!file!cabinet!in!a!lo c ke d !o ffic e!with!electron ic !d o o r!

access!control!and/or!in!sight!of!a!security!camera.!

When!Working!with!Digital!System!Files!

Digital!system!files!such!as!databases,!SAS/SPSS!data!files,!or!custom!application!record!sets!must!be!stored!in!one!of!the!

following:!

• Brandeis-provided!Box.com!account

• Brandeis-provided!and!Brandeis-certified!file!server

• Password!protected!and!encrypted!computer!file

Review!of!Findings!

The!safety!of!all!research!data!should!be!reviewed!and!the!findings!logged!on!a!daily!basis.!

Revised!May!22,!2019!