Collecting Data Directly From Participants
Identifiable Data
The PI or research team can tie responses to a individual participants. Identifiable data collected from participants by researchers in a WVU Covered Entity is considered high-rsik, sensitive data (the same as PHI) even if the collection is not in a clinical environment. Note that HIPAA does not apply to data that does not come from the electronic medical record. Identifiabledata collected by non-covered entities is considered medium-risk, research PII.
Anonymous Data
The PI or the research team cannot tie responses to individual participants. Identifiers such as name and email may be known and the PI may know who participants are, however responses cannot be tied to an individual. Anonymous data is considered low-risk data, however research data must be stored according to institutional and research policies.
Coded Data
A code is assigned in place of the participants name in the data to be used to conduct research and in outputs. The PI maintains a list that can re-identify the participant. This list must be stored in an approved, compliant data storage location.
De-identified Data
The HIPAA identifiers or research PII identifiers are removed and the data can never be reidentified by anyone on the research team.
Wearable Data
The device must be approved to collect data for research by WVU. If the data will be identifiable and stored with the vendor, a BAA must be in place, if a code is used to register the device and identifiers are not stored with the vendor, a BAA is not needed. Data transmission from the vendor to WVU approved storage must be secure and approved. Email addresses must be created and approved by WVU. Research data cannot be stored on hard drives, external drives, or USB drives.
Data Protection Form Considerations
- Consider the difference between privacy and confidentiality.
- Determine if you are conducting the research for a department that is a WVU Covered Entity as all identifiable data collected is considered Sensitive.
- Will the data be collection anonymously or will the PI or anyone on the research team be able to tie responses to the participant?
- Will coding be used?
- If images are used, will they require
de-identification before sharing or publication?
- If they will not be de-identified, does WVU or the funding agency require a data agreement?
- If video recordings will be used, will an approved technology or method be used, will screen names be used, is the
transcription service approved?
- If identifiable information will be shared, is a data agreement required by WVU?
- If audio recordings will be used, will an approved technology or method be used
for transcription?
- How will identifying information be handled?
- How will the recordings be protected?
- If identifiable information will be shared, is a data agreement required by WVU?