IRB guidelines for secure online data storage, backup, and syncing?

Question

I am asking to get people's success stories in presenting a data management case for secure data backup using remote online services, rather than the antiquated "server in a locked room" model of security.

In general, I have gotten the impression that most IRB's think that a server on-campus in a locked room is safer than a cloud server in a mysterious data center. It's an argument that doesn't hold much water to me. In the business world, vital data is stored in cloud data centers all the time. However, given that IRB boards tend to not have many data-security specialists (if any), I am not sure what kinds of guarantees are typically requested.

For those who have gone down this road, what kinds of services and guarantees were required to meet the requirements of an IRB panel (and for what level of vulnerability of subjects and disclosure risks)? For example, for medical data, I would assume that a HIPAA-compliant data service (e.g., Carbonite's Pro version) would usually be sufficient (but possibly not always). I am most interested in slightly lower-risk data (e.g., sociological or cognitive), but would be interested in any reports on reasonable and IRB-approved service requirements for storing, syncing, and sharing data on a project. Is a HIPAA-compliant storage usually sufficient? Is it sometimes sufficient to have a non-HIPAA-compliant one, but with some other types of certification or privacy guarantees? How important are guarantees that data will be fully-stored in a same-country (e.g., US) data center or on a discrete server? In short, I'm hoping to figure out the guidelines that are generally used for matching a remote data service to an IRB data management plan.

Answer 1

While this solution will likely be only a drop in the bucket for your request, I did write a paper covering security issues related to health information and HIPAA while finishing up my Master's. Section 6 has a case study on Amazon Web Services as a "HIPAA-compliant" cloud storage solution, including both its positives and its negatives.

Since this was a review paper, I feel the need to point out that I don't have any personal experience with Amazon Web Services or with setting it up for HIPAA compliance, so don't take it as an endorsement either for or against its use.

It's important to evaluate exactly what any proposed service you select actually provides. AWS, for example, supports basically the creation of the HIPAA-compliant environment. That being said, that's the creation of one, not one provided out of box. You'd have to implement a variety of features normally associated with data storage such as backing up data, auditing all changes, and so on.

Basically, you're asking what you need to do to satisfy the IRB, I guess. What you should probably be asking is what you can do to satisfy HIPAA regulations, and using that, justify that it is a viable solution to the IRB.

I can't really provide you a concrete example of an actual cloud data storage plan (the one I was involved in is non-disclosure and I'm also not an IS guy) but I might be able to answer some more conceptual questions.