In order to approve research, the IRB must determine that there are adequate provisions in place to protect the privacy of subjects and maintain the confidentiality of research records and data collected.

1.  Privacy

• Describe the steps that will be taken to promote the protection of participants’ privacy. Consider the following:
  1. The methods used to identify and contact potential participants.
  2. The settings in which an individual will be interacting with an investigator.
  3. The appropriateness of all personnel present for research activities.
  4. The methods used to obtain information about participants.
  5. The sensitivity of the requested information:
     • In relation to the potential privacy risks of the information.
     • In relation to options for participants to disclose identity.
  6. Privacy guidelines developed by relevant professional associations and scholarly disciplines (e.g., oral history, anthropology, psychology).
  7. Steps to ensure access to the minimum amount of information necessary to complete the study.
  8. Information that is obtained about individuals other than the “target participants,” and whether such individuals meet the regulatory definition of “human participant” (e.g., a participant provides information about a family member for a survey).
• Describe what personal or identifiable information will be obtained to facilitate the research and as part of data collection. If participant data will be collected without identifiers, please state this.

2.  Data Disposition

• Describe what data will be collected, including identifiable information and audio/video/digital recordings or photos. In addition, consider the following:
  1. Any other information collected to facilitate the research (i.e., contact information for recruitment).
  2. Any exiting data and its disposition (i.e. obtaining data from another source coded, or identifiable etc.).

3.  Confidentiality

• Describe the steps that will be taken to secure data and/or specimens for the research:
• Describe if participants’ private information will be coded (i.e., identifying information has been replaced with a number, pseudonym, etc.), include:
  1. How the key to decipher the code (i.e., list linking participants’ names with pseudonyms or participant number) will be stored?
  2. Who will have access to the code key?
  3. If, how, and why the code key will be retained.
• If participant identities will be disclosed as a result of this research (e.g., attributing a direct quote, etc.), provide:
  1. Justification for appropriateness of direct identification.
  2. Parameters for disclosure (e.g., will participants be allowed to review prior to dissemination).
  3. How permissions from participant will be solicited including any restrictions.
•  Describe storage and transfer including:
  1. How the data will be collected and stored, including format (e.g., audio/video recordings or photographs, hard or electronic copy, identifiable or de-identified).
  2. Security during transmission and sharing between researchers and participants.
  3. Who will have access to data (e.g., training of staff, authorization of access).
  4. How long the records will be kept after the study is completed.
  5. The security of the area where data will be stored (e.g., locked office, password protected computer, encryption, firewalls, virus detection, etc.).
• Describe any intent for future use of data beyond this research including:
  1. If other researchers will be permitted access/use the data.
  2. How data will be maintained and stored.
  3. How participant permissions for the future use will be obtained and tracked.
  4. If seeking a Certificate of Confidentiality through NIH, this needs to be stated.

Data Security Resources

• University of Oregon Data Classification Quick Reference
• University of Oregon Data Security in UO Collaboration Tools Matrix
• University of Oregon Data Handling Quick Reference