i serve on my university’s Institutional Review Board (IRB) for human subjects research. i have been charged with developing policy and procedures for how principal investigators should ensure data from human subjects is protected. this is my thinking thus far and any feedback is welcome:
- Electronic files containing participant data must be password protected even if the computer requires a login to access the computer.
- Online databases containing project data should be secure. One strategy to better secure online data is to have the database encrypted. The PI is responsible for providing the IRB with details on the following:
- The online service provider agreement for service with regard to the storage of the data;
- How long data will remain in online databases;
- Any circumstances in which the database company can use, share, or archive the de-identified data. Note: not all study data will be de-identified.
- PIs using online-based data collection tools (e.g., SurveyMonkey, Zoomerang) must provide the IRB with a link to the data collection or storage tool’s privacy policies. This policy should also explain who owns data stored on the company’s web servers.
- If data collection occurs via email, the research participant should be notified that many employers monitor email systems they maintain.
- If data being collected is personally identifiable and sensitive, the PI should consider using a Secure Socket Layer (SSL) protocol during data collection. An SSL is often used for online purchases and banking. Many popular online data collection sites will offer SSL as an option.
- Principal Investigators should warn study participants, when appropriate, that the participant is responsible for the security of the computer that the participant is using.
i think this is relevant on my blog because all teachers should be concerned about online data security when using online tools, services, or websites that pertain to their students’ data. the United States even has a law to protect student data often referred to as the Buckley Amendment.


