Skip to main
University-wide Navigation

Electronic Data

[D105.0000] Confidentiality and Data Security Guidelines for Electronic Data

Current research practices routinely involve electronic data in a variety of ways. This guideline applies to the major types of electronic data collection and data maintenance, recognizing that advances in device design, software, and university systems are constantly changing. For the latest information, refer to UK Information Technology Services. However, the basic protection provisions described are expected of investigators.

With the anticipated increase in use of electronic devices, including portable devices and drives, as well as web-based survey platforms and transcription services, data security needs greater attention on the part of investigators. The wide range of studies, methods, and electronic data devices means that investigators need to evaluate confidentiality and data security when electronic data is collected and/or stored.

The guideline applies to all studies involving electronic data that are participant-identified and that include information of a personal or health nature. This can include even low to minimal risk studies if the information is personal or health-related. Thus, personally identified minimal-risk surveys on smoking and illegal drug use would be included. Studies that would be excluded would be those with no identifying information or, if identified, cover topics that are non-personal, such as market surveys about product use. In this guidance, two terms are used for personal information: (1) personal health information (PHI) consistent with HIPAA concepts; and (2) personal identifying information (PII) for other than HIPAA-related studies – see the definitions section below for clarification.

In reviewing the guidelines below, investigators should also consult their departmental IT staff for assistance in applying the recommended data security steps. Departments vary in the ways in which they oversee and advise investigators about specific security procedures.

Definitions for electronic data collection

  • Personal health information (PHI): This is defined by HIPAA law and includes personal identifiers that are associated with medical information other than patient/subject self-reported information that may pertain to health. Information/data from medical records is considered PHI.
  • Personal identifying information (PII): For the purposes of this policy, this includes information that identify a person including any or all the following: (1) names; (2) social security numbers; (3) birth dates; (4) addresses; (5) IP addresses; (6) other data that could reasonably lead to discovering a personal identity.
  • Server: A server is a computer device with software that networks/links PCs and databases or web applications.
  • PC/Personal computer: A standalone or networked computer as a desktop device.
  • Laptop: A portable computer that includes traditional laptops, netbooks, and other portable computing devices that generally have full-range PC capacities.
  • External drives: This includes everything from jump drives to external hard drives.
  • Security tokens: Jump drive-like devices that contain security codes or de-encryptions to allow access to secure web-based data sets.
  • Smartphones and other mobile devices: Portable devices that send and receive calls, emails, text phone messages, or other communications.
  • Virtual Private Networks (VPNs): The university allows access to selected drives and folders on university servers from remote locations using software provided by the UK phone system. With a VPN, a researcher can connect to files from off-site computers using either Ethernet or wireless connectivity. VPNs are password-protected.
  • File Transfer Protocols (FTPs): FTPs are used to transfer data from off-site computers to main campus servers via web connections to specified server files. 

Data security guidance for investigators who collect, use and store electronic data

The recommended electronic devices for entering and storing human subjects data are secure servers or stand-alone PCs that have encryption software for all PHI or other identifying data. 

  • Stand-alone PCs can be used for data storage of de-identified data without encryption, but with password protection and access restricted to approved study personnel over the use of the PC.
  • Server-based PHI or other identified human subjects data should be behind a firewall and be encrypted (e.g., OneDrive).
  • Anonymous data that cannot be tracked back to a person, using cue information in the data set matched to other data sources, can be stored on servers without encryption, but still would require authorized password access.

University Provided Data Storage

  • All students, faculty, and staff have access to OneDrive as a part of the Microsoft 365 account linked to their LinkBlue user ID and password.
  • LabArchives - Electronic Research Notebook (ERN) institutional license for the UK research community. The ERN service is a secure, cloud-based software designed to replace paper notebooks and to move research record-keeping. It facilitates data storage, retention, and management of data. It enables original/raw data to be provided to those who request it and the ability to easily transmit and share data among any number of UK users; access rights are controlled by the Notebook Owner/Administrator.
  • Advarra eSource and Electronic Data Capture administered by the Clinical Research Support Office (CRSO) for FDA-regulated investigations requiring compliance with FDA Part 11. It provides robust traceability of data entered or modified within the electronic forms. The EDC system will help streamline data collection, management, and monitoring/review. The system also provides the ability to capture electronic approval signatures of collected subject data. This system will enhance overall data integrity and quality for investigator-initiated studies enterprise-wide, especially those regulated by the FDA.

Other Software

UK Information Technology (ITS) Approved Software – Sign in with UK LinkBlue ID to view instructions and the list of approved software applications.

Laptop data collection devices

Laptops may be issued by sponsors for specialized projects. These laptops are likely to have a high degree of security built in. However, sponsor-provided laptop devices should meet the same criteria as stated below.

  • The device uses software that encrypts all personal health information (PHI) or other personal identifying information (PII).
  • The data are formatted such that PHI or PII data are in files or tables kept separate from any clinical or research information about the persons.
  • All files are password-protected in addition to the laptop having a password.
  • Laptops can be used for anonymous data collection without encryption.

Jump drives

Only to be used under the following conditions:

  • The jump drive uses files that have software to automatically encrypt the entire jump drive, including all PHI or PII.
  • ORI does not recommend storing any clinical information on jump drives.

Web-based data entry

  • Web-based PHI or PII data should be put into a secure web server (https), and the server should encrypt any PHI or other identifiers upon submission. The server should be behind a firewall.
  • Web-based anonymous need not be encrypted. Firewall protections are advised but not essential.
  • Sponsor web-based data sets may require the use of a security token, like two-factor authentication, to access files. Security tokens decrypt files and open them for investigators to do data entry. These devices are acceptable for web-based data entry.

Smartphones and other mobile devices

  • The device uses software that encrypts all PHI or PII.
  • The data are formatted such that PHI or PII are in separate files or tables from any clinical or research information about the persons.

Email

PHI or PII should be limited to email communications that are sent/received from a university-issued email address and a computer connected to a UK Medical Center (MC) firewall. Type #Secure or #Encrypt at the beginning of the subject line.

Web Surveys

The university provides access to secure survey platforms. REDCap (Research Electronic Data Capture) is a secure, web-based application designed exclusively to support data capture for research studies. UK also has a site license for the Qualtrics tool for online survey creation, distribution, and reporting. 

Independent commercial survey programs where the data resides on servers owned by the survey (third-party) company. Investigators should obtain information about the tool’s security and privacy protections, including learning whether user IP addresses are captured and saved during completion of the surveys. Despite their stated privacy policies, many vendors, especially those who promote freeware, do in fact share IP addresses with their consortium of investors, and thus, absolute anonymity cannot be guaranteed to survey respondents.

The UK informed consent and survey templates include sample language regarding the protections and their limitations.  For more information, see the UK IRB Survey Research Webpage.

Teleconference

Use UK Healthcare or Campus Zoom Platforms with a unique meeting ID and password. 

The Office for Civil Rights, which administers HIPAA, has provided lists of platforms with end-to-end encryption.

Data Sharing

  • The UK Library provides resources for managing, analyzing, and sharing research data.
  • NIH Security Best Practices for Users of Controlled-Access Data require that data managed on institutional IT systems and third-party computing infrastructures that meet certain standards in accordance with NIST SP 800-171 “Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations.” Effective on January 25, 2025, adherence to this standard will be included in new or renewed Data Use Certifications or similar agreements stipulating terms of access to controlled-access human genomic data, regardless of whether the Approved User is supported by NIH or not. View the list of repositories here. If your research involves data from one or more of these repositories, you are impacted by these new policies and must follow the instructions provided. If impacted, complete the REDCap (Research Electronic Data Capture) survey to be contacted by a consultant.

Investigator Checklist for Data Protections

The following checklist was developed to assist investigators in assessing their data security and protection. The list can provide guidance on what to include in protocol narratives and in consent forms.

TOPIC GUIDANCE/RECOMMENDATIONS
Data Collection - Primary Data
Will your study collect PHI or PII about participants? If Yes: Generally, the IRB requires that research data be kept apart from PII or PHI. Separate tables or separate files should be used to maintain the confidentiality of individual records. Note this protection in the consent form.
Will the PII or PHI be kept in separate files from research data on participants?

If Yes: The crosswalk table shows the real PII or PHI along with a research record number. 

See Exhibit A below.
Will a research record number be used instead of PII or PHI in research data tables?

If Yes: The tables containing crosswalks between PII/PHI and research record numbers must be kept separately from any tables used for research.

Separate any PII or PHI from other research data. Create a crosswalk, if needed, between participant record number and PII/PHI, and ensure that the crosswalk file is separate from both the research data and the PII /PHI file. 

See examples of table structures in Exhibit A below.
Data Collection - Secondary Use Data
Will the PII or PHI be obtained from existing electronic data systems (electronic medical records, institutional data sets?

If Yes: Ensure that applicable HIPAA or other authorizations have been approved for data access into a new electronic data table.

On receiving PII or PHI, separate these identifiers from other health or research data. Create a crosswalk, if needed, between participant record number and PII/PHI, and ensure that the crosswalk file is separate from both the research data and the PII /PHI file. 

See example of table structures in Exhibit A below. 
Data Collection - Web-Based Tools
Will web survey tools be used to collect data?

If Yes: If you have the capability and expertise, host the survey in-house on a secure university firewall-walled, password-protected server. Preferred Survey Platforms:

  • Qualtrics is available to the University of Kentucky community.
  • The Center for Clinical and Translational Sciences (CCTS) administers REDCap (Research Electronic Data Capture) for the University of Kentucky. REDCap is a web-based application designed by Vanderbilt University with tools for survey-building and researcher data capture. 

UK survey researchers can access the SONA subject pool for their survey research. Instructions for creating an online internal survey or adding a Qualtrics survey are located on the Department of Psychology website.
Will the survey be hosted on a commercial or independent proprietor’s (external) server? If Yes: Be sure to find out to what extent access to the server is limited, what protections are in place to protect the data against unauthorized access, and whether the data can be encrypted upon transmission.
Are survey questions of a sensitive nature such that a breach of confidentiality could put subjects at risk? If Yes: Consent form should address the possibility of breach of confidentiality and that anonymity cannot be guaranteed and discuss relevant safeguards study personnel have implemented to minimize risk.
Data Storage - General
Will data from participants be entered directly into electronic devices during research surveys or procedures?

If Yes: Ensure that encryption is installed such that PII/PHI are always encrypted as they are entered, saved, or submitted.

The ideal is for the encryption to occur during entry, but it is acceptable to do this at “save” or “submit” functions (for VPN or other uploading). 

An example of consent language might be: “All personal identifying information is encrypted as it is typed into the laptop.” Or “All personal identifiers are encrypted when the data are uploaded.”
Will data be loaded into a server system using a virtual private network (VPN)? If Yes: The VPN-accessing server must be behind a firewall and all identifiers must be encrypted before being deposited in the VPN accessed or uploaded file or the data must be moved immediately into an encrypted file.
Data Storage – Sponsor Provided Device
Will you be using portable devices for data collection? (This includes laptops, iPads, Smartphones, and other mobile devices, etc.)

If Yes: Ensure that encryption is installed such that PII/PHI are always encrypted as they are entered, as they are saved, or submitted. The ideal is for the encryption to occur during entry, but it is acceptable at save or submit functions (for VPN, FTP, or other uploading). 

There are two ways of encrypting data for portable devices: 

  1. Encrypting the entire laptop so that a password is needed to even open any operation of the device; and
  2. Encryption only of the specific file being used for research.
Will portable devices be supplied by the sponsor?

If Yes: Ensure that the device comes with security keys or built-in encryption, either for the specific files or for the entire device.

Some sponsor-supplied devices do not use PII or PHI (research record number only) and rely on separate methods for transmitting these data. If PII or PHI are entered into or are stored on the device, ensure that the keys are in place and/ or that the PII/PHI data are encrypted.

For FDA-Regulated Clinical Investigations, the sponsor may provide documentation of compliance with Part 11 security protections.
Are you planning to put data on small portable storage devices such as jump drives? If Yes: Ensure that PII or PHI are not stored on jump drives. Other research data can be stored on jump drives if there is no way that the data could be traceable to a participant's identity (e.g., REDCap).
Data Storage – PI Owned Device
Is the device owned by the PI or by the university rather than being supplied by a sponsor? If Yes: Assume responsibility for maintaining two separate data tables (two files) and ensure that the PII or PHI table is encrypted.
Is the device a personally owned desktop PC or MAC? If Yes: Do not have any PII or PHI stored on personal desktop devices. For all other research data on human subjects, ensure that a firewall is always installed and turned on.
Data Storage – University Device
Are you using a university desktop PC or MAC for entering study data? If Yes: Ensure that your device is behind the university firewall. Ensure that backups are secured on system servers, or if an external hard drive is used for backups, ensure that it contains only encrypted PII or PHI.
Will the survey be hosted on a commercial or independent proprietor’s (external) server? If Yes: Be sure to find out to what extent access to the server is limited, what protections are in place to protect the data against unauthorized access, and whether the data can be encrypted upon transmission.
Are survey questions of a sensitive nature such that a breach of confidentiality could put subjects at risk? If Yes: Consent form should address the possibility of breach of confidentiality and that anonymity cannot be guaranteed, and discuss relevant safeguards that study personnel have implemented to minimize risk.

 

Exhibit A Crosswalk Example Between PII and Data Tables

This table would show personal identifying information (PII) associated with the research record number and would need to be encrypted.

Participant Crosswalk Table
Participant ID Number Participant Name Address Telephone Number SSN DOB
10001 John Smith 403 Plum Street, Louisville, KY 40202 502-555-5555 555-55-5555 Dec-75
10002 Ophelia Doe 600 Sixth Street, Lexington, KY 40505 859-999-9999 777-77-7777 Nov-81
10003 Justin Tyme 100 Walnut Avenue, Novgorod, KY 40699 859-888-8888 111-11-1111 Oct-82
10004 Mary Laffer 26 Clown Avenue, Lexington, KY 40509 859-777-7777 999-99-9999 Sep-86

This table would actually contain the clinical or other research data and would not need to be encrypted.

Baseline Data Table
Participant Number Gender Age Variable 1 Variable 2 Variable 3 Variable 4
10001 M 35 2 2 5 11
10002 F 29 1 3 5 13
10003 M 28 2 3 4 15
10004 F 24 2 4 7 13

Contact us

405 Kinkead Hall
University of Kentucky
Lexington, KY 40506-0057
Phone: 859-257-9428
University of Kentucky Homepage A link to return to the University of Kentucky Homepage
An Equal Opportunity University
Accreditation
Directory
Email
Privacy Policy
Accessibility
Disclosures
© University of Kentucky
Lexington, Kentucky 40506