Privacy and Partnerships
How can we design our research to balance an interest in robust data collection, with a competing interest in protecting participant privacy?
1. Have we consulted with information security experts about exactly where the data will flow, from start to finish?
2. Do we have a written policy on data deidentification and participant privacy that is consistent with best practices in psychiatry and neuroscience?
3. Have we determined which third-party vendors will be required to be HIPAA compliant and sign a Business Associate Agreement (BAA)?
Resources:
Privacy and Security in Mobile Health (mHealth) Research
https://www.ncbi.nlm.nih.gov/pmc/articles/PMC4432854/
HIPAA Privacy Rule and Sharing Information Related to Mental Health
Security HHS Security Rule Guidance Material
https://www.hhs.gov/hipaa/for-professionals/security/guidance/index.html
The HIPAA Privacy Rule’s Right of Access and Health Information Technology
https://www.hhs.gov/sites/default/files/ocr/privacy/hipaa/understanding/special/healthit/eaccess.pdf
Privacy and Confidentiality of Data Privacy and Health Research in an Data-Driven World https://www.hhs.gov/ohrp/sites/default/files/report-privacy-and-health-10-31-19.pdf
Patients’ willingness to share digital health and non-health data for research: a cross-sectional study
Health Information Privacy in the Digital Age: Where to Focus Enforcement Efforts