Data management good practices

Most research that involves human subjects requires approval by the University of Minnesota’s Institutional Review Board (IRB). See the IRB website to determine whether an IRB application is required for your project.

IRB protocols should maintain participant confidentiality without overly restricting future use of the data. 

Items to address in your IRB application:

• What data will be archived versus shared?
• What, if any, information will be destroyed at the end of the study?
• How might others use the data in the future? Will this require additional consent?
• How will data be de-identified?

• What will participants be told about how their information will be preserved and shared?

De-identification for data sharing

When collecting data from and with human participants and communities, describe protection of participants including de-identification of the data that will be done before data are shared beyond the study team. Be explicit in the process you will use to address direct and indirect identifiers.

• Direct identifiers should be completely removed from data. This includes the 18 identifiers described in the HIPAA Safe Harbor Method and any other information that directly ties to an individual.

• Indirect identifiers require close examination of the data for variables - that when combined with other variables, datasets, or publicly available information - could re-identify participants. The extent to which indirect identifiers need to be removed, recoded, or collapsed before sharing depends on the sensitivity of the data, what participants consented to, and whether data sharing will be open or more restricted. 

• Specific indirect identifiers to examine include variables that contain information about specific dates or geographical location of the participants should be examined and removed or re-coded.

• Note that a de-identified dataset is not anonymized. When crafting IRB applications, data management and sharing plans, and participant agreements, using language such as "de-identified" or "confidential" is preferred.

Resources

• Guidance regarding methods for de-identification of protected health information in accordance with the HIPAA Privacy Rule
• Human participant data essentials primer by the Data Curation Network
• Qualitative data primer by the Data Curation Network
• Johns Hopkins' 5 steps for removing identifiers from datasets
• Finnish Social Science Data Archive anonymisation template

• Consortium of European Social Science Data Archives’ anonymization of quantitative & qualitative data

Informed consent language

When collecting data from and with human participants and communities, describe how informed consent will be obtained for data preservation and sharing. Be explicit in the language you use in the consent form. Include:

• How the data will be processed before it is shared, including de-identification methods
• What data will be shared (and what data will not be shared)
• What data will be preserved rather than shared
• Where the data will be shared (name the archive or repository)
• Who will grant access (the repository or the PI)

Resources

• UMN IRB toolkit
• Consent forms primer by the Data Curation Network
• Data sharing information sheet (for researchers to share with their participants)
• ICPSR’s recommended informed consent language for data sharing
• NIH's Informed consent for secondary research with data and biospecimens

• NIH Certificate of Confidentiality requirements

For more information or additional help, contact Research Data Services at data@umn.edu.