Describe how IRBs can operationalize a limited IRB review process with institutional partners like IT Security to ensure the protection of sensitive data and regulatory compliance.
Teach participants how to classify the sensitivity of data and studies according to the new exemption criteria as well as the need for limited IRB review.
Briefly describe common security certifications that reduce the IRB burden of reviewing those product’s protections.
Use example studies to learn how to use our data security plan template, including ensuring consistency with other study protocol documents such as consents and data use agreements.
Using the innovative tools, partnerships, and process we developed at our small volume social-behavioral IRB, we will give a presentation that demonstrates how anyone can leave the conference and implement this at their home institution. Our presentation will include how to choose compliant data security tools for a shoe-string budget, which institutional partners to engage, and strategies to train researchers on the processes. We will use a case study to walk through an exemption that requires “limited IRB review,” show-casing the integration of data security tools, the review process, and data security plan template. We will incorporate any additional guidance issued by HHS and OMB after January 31, 2018 about limited IRB review.
This session will provide an overview of the EU’s GDPR and its impact on scientific research involving human subjects, highlighting the similarities and differences with HIPAA’s Privacy Rule and the Common Rule, as well as its interplay with national laws in the EU member states. We will focus on the issues of participant consent, the public interest (health) exception, and implementation of new procedures and practices required under the GDPR, including designation of a data protection officer, data protection impact assessments, rules regarding the reuse of personal data for research purposes, and notification and communication of personal data breach. The GDPR, which goes into effect on May 25, 2018, strengthens data protection principles applicable to personal data processing for scientific research purposes, adding requirements with respect to data integrity, confidentiality, accountability, and data protection by design and by default. It also introduces new definitions, such as “data concerning health,” “genetic data,” and “biometric data,” expands the rights of data subjects, specifically with respect to right to rectification, to erasure, to be forgotten, to restriction of processing, to data portability and to object, and creates opportunities for the development of codes of conduct and other self-regulatory approaches.
Institutional investment in a culture of collaboration and cooperation among all stakeholders in animal research can yield significant gains in compliance, safety, and operational efficiency. By actively engaging ancillary groups—such as Maintenance and Engineering, Security, Emergency Management, Occupational Health, and Environmental Health and Safety—some of which may not traditionally work closely with the IACUC or other compliance entities, institutions can increase the overall quality of their animal research program and better prepare for external site visits and inspections (e.g., AAALAC, USDA, CDC). Additionally, encouraging a collegial relationship among more obvious stakeholders in a program of animal care and use, from the animal husbandry staff to researchers, can contribute to the overall success of the animal program.