13

I am asking to get people's success stories in presenting a data management case for secure data backup using remote online services, rather than the antiquated "server in a locked room" model of security.

In general, I have gotten the impression that most IRB's think that a server on-campus in a locked room is safer than a cloud server in a mysterious data center. It's an argument that doesn't hold much water to me. In the business world, vital data is stored in cloud data centers all the time. However, given that IRB boards tend to not have many data-security specialists (if any), I am not sure what kinds of guarantees are typically requested.

For those who have gone down this road, what kinds of services and guarantees were required to meet the requirements of an IRB panel (and for what level of vulnerability of subjects and disclosure risks)? For example, for medical data, I would assume that a HIPAA-compliant data service (e.g., Carbonite's Pro version) would usually be sufficient (but possibly not always). I am most interested in slightly lower-risk data (e.g., sociological or cognitive), but would be interested in any reports on reasonable and IRB-approved service requirements for storing, syncing, and sharing data on a project. Is a HIPAA-compliant storage usually sufficient? Is it sometimes sufficient to have a non-HIPAA-compliant one, but with some other types of certification or privacy guarantees? How important are guarantees that data will be fully-stored in a same-country (e.g., US) data center or on a discrete server? In short, I'm hoping to figure out the guidelines that are generally used for matching a remote data service to an IRB data management plan.

  • Are the data anonymized? If so, why do you need to have a "locked room" data management plan? – Thomas Jul 31 '14 at 21:17
  • 1
    There are a few reasons. First, some types of data for research processes are inherently non-anonymous: think very large text corpora that may contain names in the text. Second, other types of data, while anonymized, can be used to uniquely identify a person. Big data sets, even with anonymized user ID's, can be used to pinpoint real people. Finally, if you are dealing with data from vulnerable populations (e.g., students), it is always prudent to store the data carefully just in case it might be used to identify users. For example, linguistic fingerprints or later college grades. – Namey Aug 1 '14 at 19:11
  • 1
    And those are just on the social-science/linguistics side. For people who work with DNA data... you can anonymize the labels it all you want, you've got their uniquely-identifying info either way. In short, with modern analytical techniques, having truly-anonymous data in a rich data set is usually a pipe dream. It's the 20-questions problem: even 20 yes-no variables can uniquely identify most individuals through history. – Namey Aug 1 '14 at 19:14
  • 2
    As said on meta, I believe this question is off-topic, since it's mostly about a technological solution for secure data handling. Might be a much better fit for security.stackexchange.com. – user102 Aug 7 '14 at 9:06
  • 1
    Does this document from LLNL help? – StrongBad Aug 8 '14 at 21:33
3

While this solution will likely be only a drop in the bucket for your request, I did write a paper covering security issues related to health information and HIPAA while finishing up my Master's. Section 6 has a case study on Amazon Web Services as a "HIPAA-compliant" cloud storage solution, including both its positives and its negatives.

Since this was a review paper, I feel the need to point out that I don't have any personal experience with Amazon Web Services or with setting it up for HIPAA compliance, so don't take it as an endorsement either for or against its use.

It's important to evaluate exactly what any proposed service you select actually provides. AWS, for example, supports basically the creation of the HIPAA-compliant environment. That being said, that's the creation of one, not one provided out of box. You'd have to implement a variety of features normally associated with data storage such as backing up data, auditing all changes, and so on.

Basically, you're asking what you need to do to satisfy the IRB, I guess. What you should probably be asking is what you can do to satisfy HIPAA regulations, and using that, justify that it is a viable solution to the IRB.

I can't really provide you a concrete example of an actual cloud data storage plan (the one I was involved in is non-disclosure and I'm also not an IS guy) but I might be able to answer some more conceptual questions.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.