Confidentiality, Privacy, and Other Applicable Regulations

Protection of Confidential Information

Researchers are responsible for protecting the privacy of research participants and maintaining the confidentiality and security of research information. This responsibility applies to information collected, received, accessed, generated, or maintained as part of a research project, whether the information is maintained electronically, in paper records, or in another format.

The research protocol must describe how participant information will be collected, accessed, stored, transmitted, and protected. Investigators should collect and retain only the information necessary to conduct the research and should limit access to individuals who have a legitimate research-related need to access the information.

The IRB application must describe the safeguards that will be used to protect research data. Depending on the nature of the study, safeguards may include:

• Removal or coding of direct identifiers;
• Use of study identification numbers or a key maintained separately from research data;
• Password protection, encryption, or other appropriate technical safeguards;
• Secure physical storage of paper records;
• Limiting access to authorized members of the research team;
• Secure methods for transferring or sharing research data;
• Procedures for protecting data during analysis and reporting; and
• A plan for retaining and securely destroying research records when they are no longer needed.

Investigators should not promise that research information is "absolutely confidential." The informed consent document should accurately describe the extent to which confidentiality will be maintained and any circumstances in which information may be disclosed, including disclosures required by law or necessary to protect participants or others when applicable.

Access to Research Records

Research records must be maintained in accordance with applicable University policies, the approved research protocol, sponsor requirements, and applicable federal and state laws.

SVSU may require access to research records when there is a legitimate University purpose, such as regulatory oversight, compliance review, audit, investigation, financial or grant administration, or other authorized University responsibilities. Access should be limited to the information necessary for the legitimate purpose and handled in a manner that protects participant privacy and confidentiality.

External sponsors, regulatory agencies, or other authorized entities may also have rights to review research records when required by applicable law, regulation, contract, grant, or other agreement.

Investigators must ensure that research team members, including co-investigators, students, trainees, consultants, and other individuals with authorized access, understand and follow the confidentiality and data-security requirements applicable to the project.

Family Educational Rights and Privacy Act (FERPA)

The Family Educational Rights and Privacy Act (FERPA) is a federal law that protects the privacy of student education records maintained by educational institutions. FERPA generally requires a signed and dated written consent before personally identifiable information (PII) from education records is disclosed, unless a specific FERPA exception applies. The consent must identify the records to be disclosed, state the purpose of the disclosure, and identify the party or class of parties to whom the disclosure may be made.

FERPA rights generally belong to the parent until the student becomes an "eligible student." An eligible student is a student who is 18 years of age or older or who attends a postsecondary institution at any age.

FERPA includes exceptions that may permit disclosure of education records without consent under specified circumstances. For example, an educational institution may disclose PII to an organization conducting a study for, or on behalf of, the institution when the study meets the requirements of the FERPA studies exception. Such disclosures require appropriate protections and a written agreement specifying, among other requirements, the purposes of the study and the use and destruction of the information.

FERPA requirements are separate from IRB requirements. IRB approval does not, by itself, authorize access to or disclosure of education records under FERPA.

Investigators who plan to access student education records should consult with the appropriate SVSU office early in the research planning process to determine whether FERPA applies and what permissions, agreements, or other requirements may be necessary.

Protection of Pupil Rights Amendment (PPRA)

The Protection of Pupil Rights Amendment (PPRA) establishes certain rights and protections for students and parents in connection with surveys, analyses, and evaluations administered by educational agencies and institutions that receive funding under programs administered by the U.S. Department of Education.

PPRA applies to surveys, analyses, or evaluations that address one or more of the following eight protected areas:

• Political affiliations or beliefs of the student or the student's parent;
• Mental or psychological problems of the student or the student's family;
• Sex behavior or attitudes;
• Illegal, anti-social, self-incriminating, or demeaning behavior;
• Critical appraisals of other individuals with whom respondents have close family relationships;
• Legally recognized privileged or analogous relationships, such as those involving lawyers, physicians, or ministers;
• Religious practices, affiliations, or beliefs of the student or the student's parent; and
• Income, except when required by law to determine eligibility for participation in a program or for financial assistance under that program.

PPRA also includes requirements concerning parental access to certain surveys and instructional materials and other student privacy protections. The specific requirements that apply depend on the funding source, educational setting, type of survey or activity, and other circumstances.

Investigators conducting research involving K–12 students should consult with the school or school district and the appropriate SVSU office early in the research planning process to determine whether PPRA applies and what additional requirements must be addressed.

Health Insurance Portability and Accountability Act (HIPAA)

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) includes federal privacy protections governing the use and disclosure of protected health information (PHI) by HIPAA-covered entities and their business associates.

HIPAA does not apply to every researcher or every research project. Its application depends on the entity involved, the information being accessed, and the circumstances under which the information is used or disclosed. When research involves PHI held by a covered entity, additional HIPAA requirements may apply.

Depending on the circumstances, research involving PHI may require:

• An individual's HIPAA Authorization;
• An IRB- or Privacy Board-approved alteration or waiver of HIPAA Authorization;
• Use of de-identified information;
• A limited data set and an appropriate Data Use Agreement; or
• Another mechanism permitted under the HIPAA Privacy Rule.

HIPAA requirements are separate from the requirements for informed consent under the Common Rule. An informed consent document does not automatically constitute HIPAA Authorization, although the two may sometimes be combined when the applicable requirements are satisfied.

Researchers must also follow applicable requirements established by the organization or health care provider that maintains the PHI. Investigators planning to access, receive, use, or disclose PHI for research should consult with the relevant covered entity and appropriate SVSU officials early in the research planning process.

Other Applicable Privacy and Confidentiality Requirements

Additional federal, state, local, institutional, or sponsor requirements may apply depending on the research population, data source, funding, research setting, or type of information collected.

Examples may include requirements governing:

• Student education records;
• Health information;
• Children and other populations requiring additional protections;
• Substance use disorder treatment records;
• Genetic or genomic information;
• Social Security numbers and other sensitive identifiers;
• Data obtained from government agencies or other organizations;
• Data covered by a Data Use Agreement or other contractual restriction; and
• Research supported by federal or other external sponsors.

Investigators are responsible for identifying applicable requirements and describing how those requirements will be addressed in the IRB application.

Key Principle

IRB approval does not replace other required permissions or legal protections. Investigators must comply with the IRB-approved protocol as well as applicable privacy laws, institutional policies, sponsor requirements, data-use agreements, and requirements imposed by organizations that provide access to research data.