Research and Ethics Guidelines

Authors conducting research are required to rigorously protect participant privacy by implementing the following four core measures for handling data:

De-identification of all personal information: This means removing or obscuring any data that could directly or indirectly link information back to an individual participant.

Secure data storage and transmission methods: Ensuring that data is protected from unauthorized access, loss, or alteration both when it's being stored (at rest) and when it's being moved (in transit).

Limited access to identifiable information: Restricting who can view or use identifiable data to only those individuals who absolutely need it for the research, typically on a "need-to-know" basis.

Proper disposal of confidential materials: Ensuring that when data or materials are no longer needed, they are destroyed in a way that prevents their recovery or misuse.

These guidelines are crucial for maintaining the trust of research participants, ensuring ethical conduct, and complying with legal and regulatory requirements (e.g., HIPAA, GDPR, institutional review board standards).

 

De-identification of all personal information:

What it means: This involves techniques like anonymization (removing all identifiers) or pseudonymization (replacing identifiers with a code or pseudonym). Direct identifiers include names, addresses, phone numbers, social security numbers. Indirect identifiers, when combined, can also identify an individual (e.g., date of birth, zip code, rare medical condition).

Why it's important: To prevent data breaches from leading to the exposure of individuals' identities and sensitive information, thereby protecting them from potential harm or discrimination.

Secure data storage and transmission methods:

What it means:

Storage: Using encrypted databases, password-protected servers, physical security for hard copies (locked cabinets/rooms), and regular backups.

Transmission: Employing secure transfer protocols (e.g., SFTP, HTTPS for web forms), encrypted email, or secure cloud services.

Why it's important: To prevent unauthorized access, hacking, theft, or accidental disclosure of participant data while it is being held or moved between researchers or systems.

 

Limited access to identifiable information:

 

What it means: Implementing role-based access control where only specific members of the research team, approved by the Principal Investigator, are granted access to identifiable data, and only for the specific tasks requiring it. This often means data is separated, with de-identified data used for analysis and identifiable keys managed by a very limited few.

Why it's important: Minimizes the risk of insider misuse or accidental disclosure. The fewer people with access to identifiable data, the lower the risk of a privacy breach.

Proper disposal of confidential materials:

What it means:

Physical materials: Shredding documents, pulverizing hard drives, or using secure confidential waste bins.

Digital materials: Securely wiping hard drives (not just deleting files), degaussing electronic media, and ensuring cloud data is permanently purged according to secure data destruction protocols.

Why it's important: To prevent data recovery after the research project concludes or after specific data is no longer needed, thereby protecting participants from future privacy violations or identity theft.

Adherence to these guidelines is fundamental to ethical research practices and the protection of human subjects.