In the event that a breach in privacy occurs, the investigator must immediately notify the hospital’s privacy officer and the REB.
In conducting research, the investigator agrees that the personal health information (PHI) collected in this study will not:
General safeguards for the storage of research data:
- Be used for future projects without prior approval of the Research Ethics Board.
- Be published in such a way that could reasonably allow others to identify the patient whose personal health information is being researched.
- Be disclosed except as required or permitted by law.
Personal Health Information must not be released externally and should be stored securely at all times. Participant ID codes based on date of birth, ethnicity, hospital record number, and residency should be avoided. Variables that can be identifying of the person either alone or in combination must similarly be avoided. Instead, participants should be coded with a study number that is not identifying of the individual. If needed, the hospital unique number can be linked to the study participant number in a separate password-protected and encrypted document. This further decreases the risk of personal information becoming accessible should the information be lost or stolen.
All research records pertaining to studies that fall under Health Canada Division 5 regulations should be retained for 25 years after closure. All other studies should retain records for a minimum 7 years after the study closure, unless otherwise approved by the REB. Long term electronically stored information should be verified or validated for accessibility and correctness every 2 to 3 years.
Information stored on mobile/portable devices:
Mobile devices (e.g., laptops, USB keys, PDAs) that contain study information should be stored securely. Study data stored on these devices should be de-identified as much as possible. Electronic files stored on mobile devices should also be password-protected, and encrypted.
If personal health information is to be released externally, a data sharing agreement must be signed between the health information custodian (Dr. Martin Osmond, CEO and Scientific Director CHEO Research Institute; VP Research, CHEO) and the external investigators.
For clinical drugs trials, the terms of data sharing are generally specified in the contract with the Sponsor. These contractual terms must be consistent with the conditions set out by the eHIL data sharing agreement.
For more information, consult the following relevant CHEO policies. Investigators must comply with the following CHEO policies in conducting research: