Data management good practices

Institutional Review Boards (IRBs)

Most research that involves human subjects requires approval by the University of Minnesota’s Institutional Review Board (IRB). See the IRB website to determine whether an IRB application is required for your project.

Write data sharing into your IRB protocol

IRB protocols should maintain participant confidentiality without overly restricting future use of the data. 

Items to address in your IRB application:

  • What data will be archived versus shared?
  • What, if any, information will be destroyed at the end of the study?
  • How might others use the data in the future? Will this require additional consent?
  • How will data be de-identified?
  • What will participants be told about how their information will be preserved and shared?

De-identification for data sharing

When collecting data from and with human participants and communities, describe protection of participants including de-identification of the data that will be done before data are shared beyond the study team. Be explicit in the process you will use to address direct and indirect identifiers.

  • Direct identifiers should be completely removed from data. This includes the 18 identifiers described in the HIPAA Safe Harbor Method and any other information that directly ties to an individual.

  • Indirect identifiers require close examination of the data for variables - that when combined with other variables, datasets, or publicly available information - could re-identify participants. The extent to which indirect identifiers need to be removed, recoded, or collapsed before sharing depends on the sensitivity of the data, what participants consented to, and whether data sharing will be open or more restricted. 

  • Specific indirect identifiers to examine include variables that contain information about specific dates or geographical location of the participants should be examined and removed or re-coded.

  • Note that a de-identified dataset is not anonymized. When crafting IRB applications, data management and sharing plans, and participant agreements, using language such as "de-identified" or "confidential" is preferred.

Resources

Informed consent language

When collecting data from and with human participants and communities, describe how informed consent will be obtained for data preservation and sharing. Be explicit in the language you use in the consent form. Include:

  • How the data will be processed before it is shared, including de-identification methods
  • What data will be shared (and what data will not be shared)
  • What data will be preserved rather than shared
  • Where the data will be shared (name the archive or repository)
  • Who will grant access (the repository or the PI)

Resources

For more information or additional help, contact Research Data Services at data@umn.edu

Last Updated: Sep 9, 2024 10:09 PM