Protection of Health Information & Human Research Participants

Protection of Health Information

Investigators are expected to keep any protected health information (PHI) in a secure database, such as Illinois REDCap. Only the portion of the de-identified data that is required for analysis needs to be provided to the biostatistician. 

HIPAA

To ensure compliance with the Health Insurance Portability and Accountability Act of 1996 (HIPAA), we strongly recommend that you de-identify your data as per the Safe Harbor Method and export it into a CSV file for analysis. This process entails removing 18 specific identifiers, including contact information such as names, telephone numbers, and email addresses, as well as health-related information such as medical record numbers or health plan beneficiary numbers.

If you require further assistance with HIPAA compliance, please contact Gillian Snyder, IHSI Senior Director for Research and Core Development, at gcooke@illinois.edu.

More information regarding University of Illinois HIPAA regulations can be found at hipaa.uillinois.edu.

Limited data sets

For some projects, it may be necessary for core staff to work with limited data sets. With a limited data set, the following information may remain in the data disclosed:

• Dates such as admission, discharge, service, DOB, DOD
• City, state, five digit or more zip code
• Ages in years, months, days, or hours

Use of a Box Health Data Folder (BHDF) is required for secure transfer of data of limited data sets.

Clients are asked to discuss data security best practices with the biostatistician during the initial consultation. If limited data sets must be used, a data use agreement may be required.

Protection of Human Research Participants

For all research involving human participants where identifiable data are to be reviewed or analyzed by core biostatisticians (including limited data sets), the core requires:

• Institutional Review Board (IRB) documentation (i.e., approval letter) prior to the commencement of biostatistical work
• The biostatistician be added to the research team, where the amendment identifying the biostatistician as a team member must also be received prior to the commencement of work

If you are unsure whether your project involves identifiable data or whether the biostatistician needs to be added to your IRB application as a research team member, please contact your institution’s IRB staff for assistance. University of Illinois investigators can contact the Office for the Protection of Research Subjects (OPRS) at irb@illinois.edu with questions.