Know the best practices.
De-identification expectations:
Where possible, research teams should avoid collecting any identifiers that are not necessary to the objectives of the project. If identifiers are necessary, de-identification of data should occur as soon as reasonably possible in the research process. Any request for directly identifiable information, such as Personal Health Numbers (PHNs), requires a strong justification and access to such information must be strictly limited within project teams.
Quasi or indirect identifiers refer to information that, in combination with other information, can be used to single out an individual. These include information such as gender, date of birth or age, event dates, unique personal characteristics, places of residence, etc. Project teams should consider the necessity of collecting indirect identifiers in relation to the project objectives and remove indirect identifiers to the extent possible. For example, month and year of birth or age at time of visit in lieu of full date of birth, and Health Service Delivery Area in lieu of postal code.
Additional resources for helping with the de-identification process can be found in a Ministry of Health policy instrument entitled Access to Health Data for Research that provides definitions for de-identification, direct identifiers and clarifies a range of other issues. Please review the guidance for more information.
Storing Data:
Data should be stored in secure, password-protected, encrypted devices in appropriate locations. Public cloud services should not be used for storing data. Fraser Health provides secure, access-controlled folders on the internal network for storing electronic research and evaluation data. These M drive folders can be requested from Service Desk (need Pulse intranet access in order to view link).
When storing physical or paper-based data, physical security controls are required, including using locked cabinets in access-controlled rooms.
Depending on the nature of the data and associated privacy risks, more stringent data storage requirements may be necessary.
Sharing Data Outside of Fraser Health:
Fraser Health Researchers and Evaluation teams can use the Cerberus Secure File Transfer Server to safely share data.
For projects and clinical trials sharing data via an e-portal, a copy of the security certificate will be requested. E-portals that have already had a PIA are:
- RedCap
- Medidata Rave.
The minimum encryption requirement for any data transfer method is 256 bit. Email is not acceptable for data transfer/sharing.
An important consideration for sharing data securely is the process in which the data will be de-identified. Where possible, de-identification of data should occur before the data leaves the health authority to minimize privacy risks. Crosswalk files that link participant personal identifiers, such names and PHNs, with study IDs, should be retained within Fraser Health and not be shared outside the health authority.
Data must only be shared to the extent necessary for the conduct of the research project and in the manner approved by the Research Ethics Board.