I am asking to get people's success stories in presenting a data management case for secure data backup using remote online services, rather than the antiquated "server in a locked room" model of security.
In general, I have gotten the impression that most IRB's think that a server on-campus in a locked room is safer than a cloud server in a mysterious data center. It's an argument that doesn't hold much water to me. In the business world, vital data is stored in cloud data centers all the time. However, given that IRB boards tend to not have many data-security specialists (if any), I am not sure what kinds of guarantees are typically requested.
For those who have gone down this road, what kinds of services and guarantees were required to meet the requirements of an IRB panel (and for what level of vulnerability of subjects and disclosure risks)? For example, for medical data, I would assume that a HIPAA-compliant data service (e.g., Carbonite's Pro version) would usually be sufficient (but possibly not always). I am most interested in slightly lower-risk data (e.g., sociological or cognitive), but would be interested in any reports on reasonable and IRB-approved service requirements for storing, syncing, and sharing data on a project. Is a HIPAA-compliant storage usually sufficient? Is it sometimes sufficient to have a non-HIPAA-compliant one, but with some other types of certification or privacy guarantees? How important are guarantees that data will be fully-stored in a same-country (e.g., US) data center or on a discrete server? In short, I'm hoping to figure out the guidelines that are generally used for matching a remote data service to an IRB data management plan.