Research projects supported by Federal funds may lend data sets
containing information identifiable to a private person to qualified
individuals or agencies. The requester must submit an Information
Transfer Agreement prior to receipt of these data. The agreement
is a written certification that the requester is knowledgeable about
28 CFR Part 22 regulations and agrees to comply with them. The request
for transfer of information should describe the general objectives
of the project for which the information is requested and provide
justification for all information requested in identifiable format. The request must also
provide justification for conclusion that the project will not, either
directly or indirectly, cause legal, economic, physical, or social
harm to individuals whose identification is revealed in the transfer
of information. The recipient of the data must also agree that:
- Information
identifiable to a private person will be used only for research
and statistical purposes and will not be used or revealed except
as allowed in the regulations.
- Access to
the requested data is limited to the recipient and his or her
employees or subcontractors having a need in connection with the
research for which the data were obtained. The individuals will
be advised of and agree in writing to comply with all of the provisions
of the regulations.
- Knowingly
and willfully using, re-transferring, re-disseminating, re-publishing
any information contrary to the provisions of the agreement shall
constitute a violation of these regulations, punishable by termination
of the grant or contract and/or legal actions described in the
regulations.
- Adequate
precautions will be taken to insure administrative and physical
security of identifiable data and to preserve the confidentiality
of personally identifiable information.
- Project
plans will be designed to preserve anonymity of private persons
to whom the information relates, including, when appropriate,
statistical disclosure methods.
- Project
finding and reports prepared for dissemination will not contain
information which can reasonably be expected to be identifiable
to a private person except as authorized under the regulations.
- Upon completion
of a research or statistical project the security of personally
identifiable information shall be protected by complete physical
destruction of all copies of the data files or the identifiable
portions of them after a three-year required recipient retention
period or as soon as authorized by law. Identifiers must be removed
from data files and a secure name-code index must be maintained.
- The Transfer
of Information Agreement, signed by the requester, signifies that
he or she is responsible for the data and will uphold the preservation
of confidentiality consistent with the requirements of 28 CFR
Part 22.
Implications
for IRB Review
Agencies that release youth data files and researchers who utilize them are subject
to all of the regulatory requirements of 28 CFR 22 that govern the
use and release of research and statistical information. Youth data
lending-agencies must provide potential data recipients with the
policies, guidelines, and procedures that define their responsibilities
for data security both during and after the research activities.
Likewise, data recipients must submit research proposals to an IRB
with sufficient information to demonstrate that the proposed study
will comply with the lenders’ criteria for collecting, storing,
using, transferring, reporting, and publishing youth data. The IRB
reviews the research proposal before the research is conducted to
ensure that the research plan includes assurances from the researcher
that the lender’s criteria for privacy and confidentiality
will be met along with a rationale and justification for doing so.
The IRB review of first-time submissions and previously approved
proposals is an on-going process to ensure confidentiality and privacy
of youth data and that the risk of harm to youth who are research
participants is minimized.
Youth
who have previously provided research information deserve the same
protection from risk and harm, as do youth who participate in primary
data collection for research.
|
