Topics for Guidance: Secondary Data, Data Security, Contracts and Collaboration

Working with Existing Datasets

About

Best Practice

IRB Implications

Required Level of IRB Review

Some data sources or data use agreements (DUAs) require a certain level of IRB review regardless of type of data. For example, even though a dataset may be considered not identifiable, the data source will require an expedited level of IRB review.

Review the DUA or other contract that may be in place for receipt of the data. Alert the IRB of this requirement in your IRB application.

The IRB will review according to the disposition of the data presented in the IRB application. Should a higher level of review be required according to the data source (or DUA), all regulations that pertain to that level of review apply. Of note, even if only one dataset requires the higher level of review, the entire submission will be reviewed according to that higher level.

Working with Multiple Datasets

Even though each dataset may be not identifiable, there may be an occasion where through a constellation of variables, the data become identifiable. Please also see topic “Identifiable” regarding how a constellation of variables may also occur within the same dataset.

Review the datasets and variables that you will be working with. Is there a possibility that a dataset may tie other datasets together to potentially identify an individual? For example, do the datasets contain variables that could link the datasets together?

The IRB will review according to the disposition of the data presented in the IRB application. Should it be evident that the data may be considered identifiable through a constellation of variables, the IRB review will treat the data as identifiable.

Collaboration

About

Best Practice

IRB Implications

MOUs/Letters of Collaboration

When working with outside institutions when that institution is considered a “site”, it may be necessary to obtain documentation of permission to conduct research at those sites.

Ask local contacts at each site whether permission is needed at the local level or in the case of schools, whether permission is needed from the district (or higher) level. If permission has been obtained, this should be documented in the IRB application.

The IRB will inquire on whether it is permissible to conduct research at the sites. If this documentation is included with the IRB application, it will make for a more efficient review process.

Who is doing what

When there are Harvard affiliated and Harvard non-affiliated individuals working on the same project, it is important to discern who is doing what.

Delineate the actions of those that are affiliated with Harvard versus those that are not. For example, if an outside agency is conducting data collection and the Harvard team is only receiving not identifiable data, indicate as such.

If the actions of those involved in a research study are not delineated, the review may be more conservative than needed.

Concept of “Agent”/”Engagement”

Agents: Each IRB has purview over their “agents”. An agent may be an employee, a student, or a volunteer. An agent is a person who has been specifically authorized to conduct human research on behalf of the organization.

Engagement: The regulatory concept of “engagement” comes into play when there is more than one institution involved in a study when the overall study would receive either expedited or convened IRB review. Of note, this concept is not applied when the overall study would be considered “exempt” or not human subjects research. The IRB uses this regulatory concept to determine which institutions require IRB review in the overall study. Engagement is determined by the actions of the agents.

When a research study involves multiple institutions, it is important to delineate who is doing what. It is important to note that “institutions” may be schools, people, or places of business.

If a person that is affiliated with one of these “institutions” is consenting study subjects, intervening or interacting with subjects, or analyzing private, identifiable data, then that person (or institution) would be considered “engaged” in the research and IRB review for their activities would be needed.

There are other instances when a person may not be engaged. For example, telling a subject about the study or providing others with identifiable information when they are not part of the overall study would not be considered “engaged” in the research and IRB review for their activities would not be needed.

More information on engagement may be found here: https://www.hhs.gov/ohrp/regulations-and-policy/guidance/guidance-on-engagement-of-institutions/index.html

It is important for IRBs to know who needs IRB review and who doesn’t. The IRB reviewer will ask about the activities of those that are not affiliated with Harvard. If it is determined that the individual’s activities “engage” them in the research, then the reviewer will ask if the non-affiliated person is obtaining their own IRB review. Often, the reviewing IRB may allow the non-affiliated person to be included in their review. This is done by way of a reliance agreement. This reliance agreement will vary in type by the type of institution.

An IRB Authorization Agreement (IAA) is used when the non-affiliated individual is associated with an institution that has a Federal Wide Assurance, or FWA. The FWA is the agreement that the institution has in place with the federal government to assure that all funded research will abide by the federal regulations for human subject protections and will be reviewed by an IRB. Most universities and institutions that regularly conduct research have a FWA.

An Individual Investigator Agreement (IIA) is used when the non-affiliated individual is either working on their own or is affiliated with an institution that does not have a FWA. Most independent contractors or smaller institutions that regularly do not conduct research will need to enter into an IIA with the reviewing IRB.

Overall purpose/Who is the driver?

There may be times when a research team is approached by an outside institution to be part of a project evaluation or other activity. This evaluation/activity may not be considered “research” according to the regulations. For example, school districts often conduct program evaluation and seek outside services to provide assistance with implementing an evaluation of their program. This assistance may be comprised of providing randomization or evaluation of the data that is collected.

In these situations, it is important to look at what the overall project/activity is and what part Harvard affiliates will perform. If the overall project/activity is considered quality improvement or program evaluation, it may not meet the regulatory definition of “research” and therefore IRB review and approval would not be needed. For an overview of common elements between program evaluation, quality improvement, and research, you may find the following graph helpful –

https://kb.wisc.edu/images/group78/33386/ElementsofQIvsResearchv11-2-08…

Although it is not required for researchers to obtain a “not research” determination from the IRB, if there is any question whether an activity requires IRB review or if documentation is needed for such a determination, it is highly recommended that the research team submit an application for IRB review. When drafting the IRB application, be certain to delineate who is doing what and append any agreements/contracts that may be in place.

It is important that activities that are not research *not* be reviewed as research by the IRB. When non-research activities are considered regulated research, more restrictive regulations are applicable as well as study auditing and oversight by other agencies (internal and external).

Fee-for-Service

Sometimes, a Harvard study team may hire an outside institution to conduct specific activities in a research study. These activities may involve data collection, data analyses, or other study activities. Harvard affiliates are generally not hired to conduct research activities as this would fall outside the mission of the University.

When utilizing an outside institution to conduct study activities, it is important to delineate their activities from Harvard affiliate activities in the IRB application. Some activities may or may not require IRB review according to the federal engagement guidance Please see previous section “Concept of “Agent”/”Engagement”.

As previously noted, it is important that only those activities that require IRB review be reviewed as such. If an outside institution is conducting activities that require IRB review, a reliance agreement (either an IAA or IIA) may be put in place if they are not able or choose not to conduct their own IRB review.

Receiving coded data from collaborators

The role of the collaborator on the research study may have implications on the level of IRB review as well as the identifiability of the coded data.

When receiving data from an outside source, it is important to also include the data provider’s role in the research study. Are they considered a collaborator? Will they be publishing with you on this research study? Will they assist with analyzing the data? If so, the gatekeeping measure that would prevent the data from being considered identifiable may not be sufficient. Depending on the activity of the data provider, the data may be considered identifiable.

More information on receipt of coded data may be found here - https://www.hhs.gov/ohrp/regulations-and-policy/guidance/research-involving-coded-private-information/index.html

It is important for the IRB to provide review for activities that qualify for IRB review. When receiving coded data, the following items are important in considering this:

Who are the investigators in the research?
What are their activities? Are they merely providing data or are they more involved? Did the collaborators collect the data specifically for *this* research study?
Is there a gatekeeping procedure in place? The gatekeeping procedure may be as simple as an agreement between the provider and the recipient or a more formal procedure such as a process that is part of a research data repository.

For information on Reliance Agreements, please see Single IRB?

For non-exempt research studies (expedited or full-committee review) IRB’s need to consider the institutional affiliations of the study team members. Some studies might include only members from Harvard University Area (HUA), whereas, other studies might include researchers from other institutions. Each institution’s IRB has purview over its “agents”. An agent is a person who has been specifically authorized to conduct human research on behalf of the organization. An agent may be an employee, a student, or a volunteer.

For researchers that are not agents of HUA, we consider whether these study team members are “engaged” in the research. The IRB uses this regulatory concept to determine which researchers require IRB oversight in the overall study. Engagement is determined by the actions of the agents. Study team members are considered engaged when they have contact with human subjects, have access to data that are identifiable, or are responsible for the design, conduct, or reporting of the research.

See case studies below for engaged study team members. Please note, this is not meant to be an exhaustive list, as non-affiliated study team member oversight happens at the discretion of the IRB and is therefore determined on a case-to-case basis.

Study Team Member Examples	Description	How to submit to the IRB	IRB Classification
A HUA student who will be working as an RA. An HUA professor who will be serving as a faculty sponsor	The researcher has an active HUA affiliation.	The researcher should be listed under Question 1 on the Study Team Members page in ESTR.	Harvard-affiliated study team member
A TA at HUA, who also works at HMS will be working on behalf of both institutions An HUA faculty member with an appointment at MIT who is helping to design the research	Some agents of HUA may have multiple affiliations.	These individuals should be listed under Question 1 and may also need to be listed under non-Harvard study personnel (Question 2) or will need separate IRB review from their own institution for the work being conducted on behalf of that institution.	Dual-affiliated study team members
A colleague at another institution who will be obtaining informed consent from study participants from that institution A student who has graduated from HUA is joining another institution, but will continue to work on the study	Those without an HUID (or those with affiliation outside of HUA), who are receiving IRB oversight from HUA in the absence of their own local IRB review, should be listed under Question 2 in ESTR.	Non-Harvard affiliates who are receiving IRB oversight from HUA in the absence of their own local IRB review, should be listed on a non-Harvard Study Personnel form, which should be uploaded under Question 2 on the Study Team Members page in ESTR. This form should include the researcher’s current affiliation, role in study, study activities, and any financial Conflicts of Interest (fCOI). An ethics training certificate for each study team member should also be submitted. **Please note, a reliance agreement may also be needed for research collaborators listed under Question 2. Please see: https://cuhs.harvard.edu/ins-and-outs-forging-reliance-agreement	Non-Harvard affiliated study team members, or collaborators

About

Best Practice

IRB Implications

The level of data identifiability is a criterion of what constitutes a human subject however it is not always easy to discern what is considered identifiable or not. “Identifiability” also varies in definition across regulations. FERPA and HIPAA define identifiability according to the inclusion of specific variables while the federal regulations for human subjects define it as, “the identity of the subject is or may be readily be ascertained by the investigator or associated with the information.”

Generally, names, addresses, email addresses, and other unique identifiers are considered “identifiable”. Other unique identifiers may include medical record numbers, MTurk IDs, or other systems that directly link to an individual’s name/identity. There may also be a constellation of variables that may identify an individual. This constellation may occur within one dataset or when datasets are linked together by a common variable.

Describe in detail the type of data that you are receiving. If there are data use agreements in place for data that you are receiving, then please mention any restrictions or use limitations.

Identifiable data are people according to the federal human subject regulations. If the data involves prisoners, then the regulatory subpart pertaining to prisoners must be applied; just as data from children would need to be reviewed according to Subpart C. If identifiable data are obtained without permission, the IRB would also need to consider the appropriateness of granting a waiver of consent.

About

Best Practice

IRB Implications

A pilot study is a small-scale preliminary study that may be conducted in order to evaluate feasibility prior to performance of a full-scale research project. Sometimes pilot studies are conducted to collect initial data in support of or preparation for a grant submission. Pilot studies involving human subjects may qualify as “research” and therefore must be submitted for IRB review and approval.

If you are conducting a pilot study, it is best to contact the IRB to request a consultation or submit an IRB application for a determination of whether IRB review is required or not.

The IRB reviews all research with human subjects according to the federal regulations regardless of whether the study is a pilot study or any other type of study as long as the regulatory of definition of “research” is met.

About	Best Practice	IRB Implications
Data use agreements (DUA) are a binding agreement between a data holder and a data recipient. DUAs will outline the restrictions (IRB review, data security, third party release, destruction date, etc.) as they pertain to the data set that a researcher may receive. If the research team is providing data to others, the DUA will also protect/safeguard the data and how it is used by the recipient.	If your research will involve the release or receipt of data, the research team should inquire with the Office of Sponsored Programs (OSP) representative. Should a DUA include restrictions on IRB level of review, please include a statement to this effect in the IRB application.	The IRB provides review according to the information provided in the IRB application. Should a DUA also be included, the IRB will review the content for informational purposes only. The IRB has no purview over the negotiation or content of the DUA. In regard to restrictions that are included in a DUA, the IRB will only apply restrictions as they pertain to level of review. Data security as well as other restrictions are the responsibility of those that receive the data.

About

Best Practice

IRB Implications

Harvard University’s Information Security Policy addresses the need to protect confidential and sensitive information that is maintained in the various spheres of University administration.

See Harvard Research Data Management for more information.

Researchers are responsible for identifying confidentiality and data security obligations and implementing safeguards to properly protect research data. In the IRB application, researchers are to describe the potential sensitivity of the information used or collected.

The IRB’s responsibility according to the policy is to assign a level of sensitivity (Non-Sensitive or Sensitive) based on the type of data collected/used in the research and described in the IRB application. Should a researcher choose to hold the data at a higher security than the IRB determined, either by choice or requirement (e.g., because of a DUA or other requirements), this is the choice of the researcher. The level of sensitivity that is assigned by the IRB is the “floor.”

that receive a Sensitive designation must have a HUIT review and approval prior to IRB approval. In this review, HUIT will assign the Data Security Level historically assigned by the IRB.

Some research/data centers (“facilities”) may receive an official designation for their center through HUIT to secure data of certain sensitivities/Data Security Levels. Please refer to the policy for more information.

About	Best Practice	IRB Implications
For research studies that may pose management challenges and/or reputational risk, the Office of the Provost has established a review that is separate and distinct from IRB review. Most studies that receive Provostial Review are for studies that receive expedited review and take place in a foreign country or studies that may cause a reputational risk to the university.	The Provostial Review is not an IRB review; however, the IRB acts as a messenger for requested information or revisions to the protocol.	The IRB initiates the Provostial Review process during their standard review. If the Provost requires additional information or has requested revisions to the protocol, these requests will be conveyed to the researcher by the IRB. Please see the following link for the Provostial Review criteria - https://osp.finance.harvard.edu/provost-criteria

About

Best Practice

IRB Implications

Schools that grant access to researchers may also impose requirements, such as district approvals or informed consent processes that would not be required by the IRB.

As when involving any outside entity, it is always a good idea to seek permission. With some locations, it is sufficient to obtain permission from the local school while for others it may be necessary to seek this from the school district. Very rarely it is sufficient to seek permission only from the teacher.

Many schools require that parents be notified of all activities taking place regardless if the activity is research. Or, if there is videotaping that is taking place. Other schools may have time requirements on how long a research activity may take place in a classroom or with a group of students. These requirements may vary greatly.

While the IRB office may provide some best practices or tips for the researcher, because of the differences among schools, districts, and the like, it is the researcher’s responsibility to determine what these requirements are.

About

IRB Implications

The Family Educational Rights and Privacy Act (FERPA) (34 CFR Part 99)

http://www.ed.gov/policy/gen/guid/fpco/ferpa/index.html

FERPA applies to research involving student education records for any institution receiving U.S. Department of Education funding, meaning that it applies to most public and private K‐12 schools as well as most public and private colleges and universities. Access to identifiable student records requires written permission from the parent (for minors) or from the adult student unless the research is being conducted by the researcher on behalf of the school.

The IRB has no role in FERPA compliance other than to advise researchers when the regulation may be applicable.

About		IRB Implications
The Protection of Pupil Rights Amendment (PPRA) (34 CFR Part 98) https://studentprivacy.ed.gov/topic/protection-pupil-rights-amendment-ppra The PPRA, created by the No Child Left Behind Act, applies to survey research conducted in elementary and secondary schools receiving funds under U.S. Department of Education programs. The provisions of the PPRA apply to surveys that involve specific sensitive survey topics. The PPRA includes requirements for parental permission as well as for making survey questions available for parental review prior to administration.		The IRB has no role in PPRA compliance other than to advise researchers when the regulation may be applicable.

About		IRB Implications
Children's Online Privacy Protection Rule ("COPPA") (16 CFR Part 312) COPPA imposes certain requirements on operators of websites or online services directed to children under 13 years of age, and on operators of other websites or online services that have actual knowledge that they are collecting personal information online from a child under 13 years of age.		The IRB has no role in COPPA compliance other than to advise researchers when the regulation may be applicable.

About	Best Practice	IRB Implications
Public information is information that can be freely used, reused and redistributed by anyone with no existing local, national or international legal restrictions on access or usage.	As there are subtle variations in what may be considered publicly available, check in with the IRB office if there are any questions.	Some public information is not regulated by the IRB.

About	Best Practice	IRB Implications
A public space is any area that is not considered a private residence or private workspace and where the participant does not have an expectation of privacy. Special permissions are not needed to be in a public space. Schools are generally not considered a public space.	As there are subtle variations in what may be considered a public location, check in with the IRB office if there are any questions.	What is considered a “public location” is an important distinction for exempt research.

About	Best Practice	IRB Implications
When the IRB assists researchers in determining whether new procedures should be incorporated into an existing project or submitted as a standalone project, we consider 3Ps: purpose, population, and procedures. That is, we consider whether the new procedures are meant to answer the same research aims as the current protocol; are generally focused on the same population of interest (not necessarily the same sample, but there are unifying qualities); and are complementary to the already approved procedures. If the 3Ps align, then a modification should be submitted; if different, a new submission would most likely be needed.	Follow the 3 P’s when deciding whether an initial submission or a modification should be submitted. Check in with your IRB reviewer if in doubt.	Unwieldy studies are a challenge to review for the IRB as well as a challenge to manage for the researcher. Moreover, a complicated application may inevitably lead to non-compliance as it is difficult to gain a full and comprehensive picture of the overall study.

Topic	Description	How to submit to IRB	Case Studies
Third Party Participants In some cases, a researcher might obtain private, identifiable information about a third party, who is not the focus of the study.
Obtaining Third-Party Consent	In some cases it may be feasible to obtain informed consent from third-party participants.	Indicate in the Informed Consent section of the protocol how you will obtain informed consent from third-party participants. (Be sure to highlight any differences between third-party and primary participants, as needed.)	A researcher obtains information from a teacher about her students’' grades, but will also obtain parental permission from parents and assent from the students.
Not Obtaining Third-Party Consent	In some cases it may not be practicable to obtain informed consent from third party participants.	Indicate in the Informed Consent section of the protocol that you will not obtain informed consent, and why it would not be practicable to do so.	A researcher is interested in social support networks in a small community. To understand these networks, the researcher will interview participants and obtain information about who their supporters are and how they provide support. It may not be feasible to obtain informed consent from the supporters because their identities are unknown to the researcher until the interview.

Topic	Description	How to submit to IRB	Case Studies
Deception and Incomplete Disclosure These two terms are commonly confused. Some studies use one or both in order to protect the integrity of the research data or reduce bias.
Deception	Deception is the intentional misleading of a participant about the nature of the study.	Follow the instructions provided in the Deception and Incomplete Disclosure section of the protocol for how to justify why it is appropriate to actively deceive participants as part of your research study.	The PI is researching stress responses. In order to induce stress, participants are asked to give a 5-minute speech and are told that it will be video recorded for analysis.In reality the speech is not actually recorded.
Incomplete Disclosure	Incomplete disclosure occurs when certain details of a study are deliberately withheld from participants.	Follow the instructions provided in the Deception and Incomplete Disclosure section of the protocol for how to justify why it is appropriate to withhold information from participants as part of your research study.	The PI is studying implicit gender bias and does not want participants to know the full details of this because it could impact participants’ responses and the overall integrity of the research data.

Topics for Guidance: Secondary Data, Data Security, Contracts and Collaboration

The following drop down menu offers topics for guidance in social, behavioral, and education research.

Working with Existing Datasets expand_more

Working with Existing Datasets

Collaboration expand_more

Collaboration

Collaboration Case Studies & How to Navigate ESTR expand_more

Identifiability expand_more

Pilot Activities/Studies expand_more

Data Use Agreements expand_more

Harvard Research Data Security Policy expand_more

Provostial Review expand_more

Working with Schools expand_more

FERPA - Family Educational Rights and Privacy Act expand_more

PPRA - Protection of Pupil Rights Amendment expand_more

COPPA - Children's Online Privacy Protection Rule expand_more

What is Considered "Public Information" expand_more

What is Considered "Public Space/Location" expand_more

New Submission Versus Modification expand_more

Third-Party Participants expand_more

Deception and Incomplete Disclosure expand_more