Topics for Guidance: Secondary Data, Data Security, Contracts and Collaboration
Working with Existing Datasets
About | Best Practice | IRB Implications |
---|---|---|
Required Level of IRB Review Some data sources or data use agreements (DUAs) require a certain level of IRB review regardless of type of data. For example, even though a dataset may be considered not identifiable, the data source will require an expedited level of IRB review. |
Review the DUA or other contract that may be in place for receipt of the data. Alert the IRB of this requirement in your IRB application. |
The IRB will review according to the disposition of the data presented in the IRB application. Should a higher level of review be required according to the data source (or DUA), all regulations that pertain to that level of review apply. Of note, even if only one dataset requires the higher level of review, the entire submission will be reviewed according to that higher level. |
Working with Multiple Datasets Even though each dataset may be not identifiable, there may be an occasion where through a constellation of variables, the data become identifiable. Please also see topic “Identifiable” regarding how a constellation of variables may also occur within the same dataset. |
Review the datasets and variables that you will be working with. Is there a possibility that a dataset may tie other datasets together to potentially identify an individual? For example, do the datasets contain variables that could link the datasets together? | The IRB will review according to the disposition of the data presented in the IRB application. Should it be evident that the data may be considered identifiable through a constellation of variables, the IRB review will treat the data as identifiable. |
Collaboration
About | Best Practice | IRB Implications | |
---|---|---|---|
|
Ask local contacts at each site whether permission is needed at the local level or in the case of schools, whether permission is needed from the district (or higher) level. If permission has been obtained, this should be documented in the IRB application. |
The IRB will inquire on whether it is permissible to conduct research at the sites. If this documentation is included with the IRB application, it will make for a more efficient review process. | |
Who is doing what When there are Harvard affiliated and Harvard non-affiliated individuals working on the same project, it is important to discern who is doing what. |
Delineate the actions of those that are affiliated with Harvard versus those that are not. For example, if an outside agency is conducting data collection and the Harvard team is only receiving not identifiable data, indicate as such. | If the actions of those involved in a research study are not delineated, the review may be more conservative than needed. | |
Concept of “Agent”/”Engagement” Agents: Each IRB has purview over their “agents”. An agent may be an employee, a student, or a volunteer. An agent is a person who has been specifically authorized to conduct human research on behalf of the organization. Engagement: The regulatory concept of “engagement” comes into play when there is more than one institution involved in a study when the overall study would receive either expedited or convened IRB review. Of note, this concept is not applied when the overall study would be considered “exempt” or not human subjects research. The IRB uses this regulatory concept to determine which institutions require IRB review in the overall study. Engagement is determined by the actions of the agents. |
When a research study involves multiple institutions, it is important to delineate who is doing what. It is important to note that “institutions” may be schools, people, or places of business. If a person that is affiliated with one of these “institutions” is consenting study subjects, intervening or interacting with subjects, or analyzing private, identifiable data, then that person (or institution) would be considered “engaged” in the research and IRB review for their activities would be needed. There are other instances when a person may not be engaged. For example, telling a subject about the study or providing others with identifiable information when they are not part of the overall study would not be considered “engaged” in the research and IRB review for their activities would not be needed. More information on engagement may be found here: https://www.hhs.gov/ohrp/regulations-and-policy/guidance/guidance-on-engagement-of-institutions/index.html |
|
|
Overall purpose/Who is the driver? There may be times when a research team is approached by an outside institution to be part of a project evaluation or other activity. This evaluation/activity may not be considered “research” according to the regulations. For example, school districts often conduct program evaluation and seek outside services to provide assistance with implementing an evaluation of their program. This assistance may be comprised of providing randomization or evaluation of the data that is collected. |
|
It is important that activities that are not research *not* be reviewed as research by the IRB. When non-research activities are considered regulated research, more restrictive regulations are applicable as well as study auditing and oversight by other agencies (internal and external). | |
Fee-for-Service Sometimes, a Harvard study team may hire an outside institution to conduct specific activities in a research study. These activities may involve data collection, data analyses, or other study activities. Harvard affiliates are generally not hired to conduct research activities as this would fall outside the mission of the University. |
When utilizing an outside institution to conduct study activities, it is important to delineate their activities from Harvard affiliate activities in the IRB application. Some activities may or may not require IRB review according to the federal engagement guidance Please see previous section “Concept of “Agent”/”Engagement”. | As previously noted, it is important that only those activities that require IRB review be reviewed as such. If an outside institution is conducting activities that require IRB review, a reliance agreement (either an IAA or IIA) may be put in place if they are not able or choose not to conduct their own IRB review. | |
Receiving coded data from collaborators The role of the collaborator on the research study may have implications on the level of IRB review as well as the identifiability of the coded data. |
When receiving data from an outside source, it is important to also include the data provider’s role in the research study. Are they considered a collaborator? Will they be publishing with you on this research study? Will they assist with analyzing the data? If so, the gatekeeping measure that would prevent the data from being considered identifiable may not be sufficient. Depending on the activity of the data provider, the data may be considered identifiable. More information on receipt of coded data may be found here - https://www.hhs.gov/ohrp/regulations-and-policy/guidance/research-involving-coded-private-information/index.html |
|
For information on Reliance Agreements, please see Single IRB?
Collaboration Case Studies & How to Navigate ESTR
For non-exempt research studies (expedited or full-committee review) IRB’s need to consider the institutional affiliations of the study team members. Some studies might include only members from Harvard University Area (HUA), whereas, other studies might include researchers from other institutions. Each institution’s IRB has purview over its “agents”. An agent is a person who has been specifically authorized to conduct human research on behalf of the organization. An agent may be an employee, a student, or a volunteer.
For researchers that are not agents of HUA, we consider whether these study team members are “engaged” in the research. The IRB uses this regulatory concept to determine which researchers require IRB oversight in the overall study. Engagement is determined by the actions of the agents. Study team members are considered engaged when they have contact with human subjects, have access to data that are identifiable, or are responsible for the design, conduct, or reporting of the research.
See case studies below for engaged study team members. Please note, this is not meant to be an exhaustive list, as non-affiliated study team member oversight happens at the discretion of the IRB and is therefore determined on a case-to-case basis.
Study Team Member Examples | Description | How to submit to the IRB | IRB Classification |
---|---|---|---|
A HUA student who will be working as an RA. An HUA professor who will be serving as a faculty sponsor |
The researcher has an active HUA affiliation. | The researcher should be listed under Question 1 on the Study Team Members page in ESTR. | Harvard-affiliated study team member |
A TA at HUA, who also works at HMS will be working on behalf of both institutions An HUA faculty member with an appointment at MIT who is helping to design the research |
Some agents of HUA may have multiple affiliations. | These individuals should be listed under Question 1 and may also need to be listed under non-Harvard study personnel (Question 2) or will need separate IRB review from their own institution for the work being conducted on behalf of that institution. | Dual-affiliated study team members |
A colleague at another institution who will be obtaining informed consent from study participants from that institution A student who has graduated from HUA is joining another institution, but will continue to work on the study |
Those without an HUID (or those with affiliation outside of HUA), who are receiving IRB oversight from HUA in the absence of their own local IRB review, should be listed under Question 2 in ESTR. | Non-Harvard affiliates who are receiving IRB oversight from HUA in the absence of their own local IRB review, should be listed on a non-Harvard Study Personnel form, which should be uploaded under Question 2 on the Study Team Members page in ESTR. This form should include the researcher’s current affiliation, role in study, study activities, and any financial Conflicts of Interest (fCOI). An ethics training certificate for each study team member should also be submitted. **Please note, a reliance agreement may also be needed for research collaborators listed under Question 2. Please see: https://cuhs.harvard.edu/ins-and-outs-forging-reliance-agreement | Non-Harvard affiliated study team members, or collaborators |
Identifiability
About | Best Practice | IRB Implications | |
---|---|---|---|
|
Describe in detail the type of data that you are receiving. If there are data use agreements in place for data that you are receiving, then please mention any restrictions or use limitations. | Identifiable data are people according to the federal human subject regulations. If the data involves prisoners, then the regulatory subpart pertaining to prisoners must be applied; just as data from children would need to be reviewed according to Subpart C. If identifiable data are obtained without permission, the IRB would also need to consider the appropriateness of granting a waiver of consent. |
Pilot Activities/Studies
About | Best Practice | IRB Implications | |
---|---|---|---|
|
If you are conducting a pilot study, it is best to contact the IRB to request a consultation or submit an IRB application for a determination of whether IRB review is required or not. | The IRB reviews all research with human subjects according to the federal regulations regardless of whether the study is a pilot study or any other type of study as long as the regulatory of definition of “research” is met. |
Data Use Agreements
About | Best Practice | IRB Implications |
---|---|---|
Data use agreements (DUA) are a binding agreement between a data holder and a data recipient. DUAs will outline the restrictions (IRB review, data security, third party release, destruction date, etc.) as they pertain to the data set that a researcher may receive. If the research team is providing data to others, the DUA will also protect/safeguard the data and how it is used by the recipient. | If your research will involve the release or receipt of data, the research team should inquire with the Office of Sponsored Programs (OSP) representative. Should a DUA include restrictions on IRB level of review, please include a statement to this effect in the IRB application. |
The IRB provides review according to the information provided in the IRB application. Should a DUA also be included, the IRB will review the content for informational purposes only. The IRB has no purview over the negotiation or content of the DUA. In regard to restrictions that are included in a DUA, the IRB will only apply restrictions as they pertain to level of review. Data security as well as other restrictions are the responsibility of those that receive the data. |
Harvard Research Data Security Policy
About | Best Practice | IRB Implications | |
---|---|---|---|
Harvard University’s Information Security Policy addresses the need to protect confidential and sensitive information that is maintained in the various spheres of University administration. See Harvard Research Data Management for more information. |
Researchers are responsible for identifying confidentiality and data security obligations and implementing safeguards to properly protect research data. In the IRB application, researchers are to describe the potential sensitivity of the information used or collected. |
|
Provostial Review
About | Best Practice | IRB Implications |
---|---|---|
For research studies that may pose management challenges and/or reputational risk, the Office of the Provost has established a review that is separate and distinct from IRB review. Most studies that receive Provostial Review are for studies that receive expedited review and take place in a foreign country or studies that may cause a reputational risk to the university. | The Provostial Review is not an IRB review; however, the IRB acts as a messenger for requested information or revisions to the protocol. |
The IRB initiates the Provostial Review process during their standard review. If the Provost requires additional information or has requested revisions to the protocol, these requests will be conveyed to the researcher by the IRB. Please see the following link for the Provostial Review criteria - https://osp.finance.harvard.edu/provost-criteria |
Working with Schools
About | Best Practice | IRB Implications | ||
---|---|---|---|---|
Schools that grant access to researchers may also impose requirements, such as district approvals or informed consent processes that would not be required by the IRB. |
|
|
FERPA - Family Educational Rights and Privacy Act
About | IRB Implications | ||
---|---|---|---|
|
The IRB has no role in FERPA compliance other than to advise researchers when the regulation may be applicable. |
PPRA - Protection of Pupil Rights Amendment
About | IRB Implications | |
---|---|---|
The Protection of Pupil Rights Amendment (PPRA) (34 CFR Part 98) https://studentprivacy.ed.gov/topic/protection-pupil-rights-amendment-ppra The PPRA, created by the No Child Left Behind Act, applies to survey research conducted in elementary and secondary schools receiving funds under U.S. Department of Education programs. The provisions of the PPRA apply to surveys that involve specific sensitive survey topics. The PPRA includes requirements for parental permission as well as for making survey questions available for parental review prior to administration. |
The IRB has no role in PPRA compliance other than to advise researchers when the regulation may be applicable. |
COPPA - Children's Online Privacy Protection Rule
About | IRB Implications | |
---|---|---|
Children's Online Privacy Protection Rule ("COPPA") (16 CFR Part 312) COPPA imposes certain requirements on operators of websites or online services directed to children under 13 years of age, and on operators of other websites or online services that have actual knowledge that they are collecting personal information online from a child under 13 years of age. |
The IRB has no role in COPPA compliance other than to advise researchers when the regulation may be applicable. |
What is Considered "Public Information"
About | Best Practice | IRB Implications |
---|---|---|
Public information is information that can be freely used, reused and redistributed by anyone with no existing local, national or international legal restrictions on access or usage. | As there are subtle variations in what may be considered publicly available, check in with the IRB office if there are any questions. | Some public information is not regulated by the IRB. |
What is Considered "Public Space/Location"
About | Best Practice | IRB Implications |
---|---|---|
|
As there are subtle variations in what may be considered a public location, check in with the IRB office if there are any questions. | What is considered a “public location” is an important distinction for exempt research. |
New Submission Versus Modification
About | Best Practice | IRB Implications |
---|---|---|
When the IRB assists researchers in determining whether new procedures should be incorporated into an existing project or submitted as a standalone project, we consider 3Ps: purpose, population, and procedures. That is, we consider whether the new procedures are meant to answer the same research aims as the current protocol; are generally focused on the same population of interest (not necessarily the same sample, but there are unifying qualities); and are complementary to the already approved procedures. If the 3Ps align, then a modification should be submitted; if different, a new submission would most likely be needed. |
Follow the 3 P’s when deciding whether an initial submission or a modification should be submitted. Check in with your IRB reviewer if in doubt. | Unwieldy studies are a challenge to review for the IRB as well as a challenge to manage for the researcher. Moreover, a complicated application may inevitably lead to non-compliance as it is difficult to gain a full and comprehensive picture of the overall study. |
Third-Party Participants
Topic | Description | How to submit to IRB | Case Studies |
---|---|---|---|
Third Party Participants In some cases, a researcher might obtain private, identifiable information about a third party, who is not the focus of the study. |
|||
Obtaining Third-Party Consent | In some cases it may be feasible to obtain informed consent from third-party participants. | Indicate in the Informed Consent section of the protocol how you will obtain informed consent from third-party participants. (Be sure to highlight any differences between third-party and primary participants, as needed.) | A researcher obtains information from a teacher about her students’' grades, but will also obtain parental permission from parents and assent from the students. |
Not Obtaining Third-Party Consent | In some cases it may not be practicable to obtain informed consent from third party participants. | Indicate in the Informed Consent section of the protocol that you will not obtain informed consent, and why it would not be practicable to do so. | A researcher is interested in social support networks in a small community. To understand these networks, the researcher will interview participants and obtain information about who their supporters are and how they provide support. It may not be feasible to obtain informed consent from the supporters because their identities are unknown to the researcher until the interview. |
Deception and Incomplete Disclosure
Topic | Description | How to submit to IRB | Case Studies |
---|---|---|---|
Deception and Incomplete Disclosure |
|||
Deception | Deception is the intentional misleading of a participant about the nature of the study. | Follow the instructions provided in the Deception and Incomplete Disclosure section of the protocol for how to justify why it is appropriate to actively deceive participants as part of your research study. | The PI is researching stress responses. In order to induce stress, participants are asked to give a 5-minute speech and are told that it will be video recorded for analysis.In reality the speech is not actually recorded. |
Incomplete Disclosure | Incomplete disclosure occurs when certain details of a study are deliberately withheld from participants. | Follow the instructions provided in the Deception and Incomplete Disclosure section of the protocol for how to justify why it is appropriate to withhold information from participants as part of your research study. | The PI is studying implicit gender bias and does not want participants to know the full details of this because it could impact participants’ responses and the overall integrity of the research data. |