Confidentiality & Security of Data. Users shall access University Data only to conduct University business and only as permitted by applicable confidentiality and privacy laws. Users must not attempt to access data on systems they are not expressly authorized to access. Users shall maintain all records containing University data in accordance with University’s Records Retention Policy and Records Management Guidelines. Users shall not disclose Confidential Data except as permitted or required by law and only as part of their official University duties. Whenever feasible, Users shall store Confidential Information or other information essential to the mission of University on a centrally managed server, rather than a local hard drive or portable device. In cases when a User must create or store Confidential or essential University Data on a local hard drive or a portable device such as a laptop computer, tablet computer, or, smart phone, the User must ensure the data is encrypted in accordance with University, System’s and any other applicable requirements. The following University Data must be encrypted during transmission over an unsecured network: Social Security Numbers; personally identifiable Medical and Medical Payment information; Driver’s License Numbers and other government issued identification numbers; Education Records subject to the Family Educational Rights & Privacy Act (FERPA); credit card or debit card numbers, plus any required code or PIN that would permit access to an individual’s financial accounts; bank routing numbers; and other University Data about an individual likely to expose the individual to identity theft. Email sent to and received from System and U. T. System institutions using University and/or System provided email accounts is automatically encrypted. The Office of Information Technology [or other applicable office] will provide tools and processes for Users to send encrypted data over unsecured networks to and from other locations. Users who store University Data using commercial cloud services must use services provided or sanctioned by University, rather than personally obtained cloud services. Users must not use security programs or utilities except as such programs are required to perform their official duties on behalf of University. All computers connecting to a University’s network must run security software prescribed by the Information Security Officer as necessary to properly secure University Resources. Devices determined by University to lack r...
Confidentiality & Security of Data a. What protected health information (medical information along with the HIPAA identifiers) about subjects will be collected and used for the research? PHI that will be collected includes names, addresses, phone numbers, and email addresses for locator purposes. Our study assessments/forms have been designed to avoid collecting identifiable information (e.g., no PHI identifiers are collected on CRFs). The only dates collected are protocol session dates. These are changed to ‘number of sessions completed’ when data sets are anonymized and released to other investigators.
