Protection of Health Information

  • Investigators are expected to keep any protected health information (PHI) in a secure database. Only the portion of the de-identified data that is required for analysis needs to be provided to the biostatistician. 
  • To ensure compliance with the Health Insurance Portability and Accountability Act of 1996 (HIPAA), please de-identify your data as per the Safe Harbor Method and export it into a CSV file for analysis. This process entails removing 18 specific identifiers, including contact information such as names, telephone numbers, and email addresses, as well as health-related information such as medical record numbers or health plan beneficiary numbers. 
  • For some projects, it may be necessary for core staff to work with limited data sets. With a limited data set, the following information may remain in the data disclosed:
    • Dates such as admission, discharge, service, DOB, DOD
    • City, state, five digit or more zip code
    • Ages in years, months, days, or hours
  • Use of a Box Health Data Folder (BHDF) is required for secure transfer of data of limited data sets.
  • Clients are asked to discuss data security best practices with the biostatistician in the event that limited data sets must be used, as a data use agreement may be required.
  • If you require assistance with HIPAA compliance after having consulted this document and the resources hyperlinked herein, please contact Gillian Cooke, (217) 300-6079.
  • More information regarding University of Illinois HIPAA regulations can be found at

Protection of Human Subjects

  • For all research involving human subjects where identifiable data are to be reviewed or analyzed by core biostatisticians (including limited data sets), the core requires:
    • Institutional Review Board (IRB) documentation (i.e., approval letter) prior to the commencement of biostatistical work 
    • The biostatistician be added to the research team, where the amendment identifying the biostatistician as a team member must also be received prior to the commencement of work 
  • If you are unsure whether your project involves identifiable data or whether the biostatistician needs to be added to your IRB application as a research team member, please contact your institution’s IRB staff for assistance. University of Illinois investigators can contact the Office for the Protection of Research Subjects (OPRS) at with questions.