On This Page
A Technology Review is a joint assessment performed by the Information Security Governance, Risk and Compliance (“Info Sec GRC”) team and the Compliance Office.
The purpose is to look at the electronic systems and tools being used in a study and identify possible security risks around research data and participant information.
As an outcome of the review, study teams may receive recommended safeguards or required mitigation strategies along with the risk level.
What studies require a Technology Review?
A Technology Review is required for studies undergoing review by the Fred Hutch IRB if either of the following apply:
- Involve collection of Restricted Use Data directly from participants through the use of an electronic system or technology
- Use an electronic informed consent (e-consent) platform other than Florence
There are exceptions to this requirement. Studies that exclusively use electronic systems or technology published on the Fred Hutch Systems and Services Guide (Fred Hutch credentials are required to access) and used in the published configuration (if applicable) are not required to undergo a Technology Review. Please refer to the guide for the most up-to-date list or contact the Compliance Office for consultation.
The Fred Hutch IRB relies on this institutional Technology Review to support the IRB reviews and to help ensure the technology solutions do not unreasonably compromise participant protection aims. Pending Technology Reviews will be a condition of IRB approval.
Note that any study may be directed to obtain Technology Review at the discretion of Fred Hutch Compliance, the Institutional Review Office (IRO), or Institutional Review Board (IRB).
When should the Technology Review be initiated?
Study teams are encouraged to begin the Technology Review process as early as possible to help prevent delays in IRB approval. The review may be initiated at any time prior to, or at the same time as, submission to the Fred Hutch IRB. Please plan for a turnaround time of up to three weeks for the Technology Review to be completed.
What are examples of Restricted Use Data?
Restricted Use Data is the most restrictive data category based on the Fred Hutch Data Classification Policy. The Data Classification Guide (Fred Hutch credentials are required to access) offers some examples of Restricted Use Data. Though not exhaustive as that Guide, some examples of Restricted Use Data are as follows:
- Study participant demographic data (phone number, home address, email address, etc.)
- Protected Health Information (PHI) as defined by HIPAA (including Limited Data Sets)
- Individually identifiable health information not regulated by HIPAA, including employee and student health information.
- Research data containing participants’ Personally Identifiable Information (PII) or other sensitive data that could cause harm to participants if made public
- Name in combination with Social Security number, driver’s license number, full date of birth, health insurance policy number, medical history, or biometric data
- Photographs and audio or visual recordings of study participants
- Data and information controlled by U.S. Export Control laws and regulations such as the International Traffic in Arms Regulations (ITAR) or Export Administration Regulations (EAR), e.g., technical information about a controlled pathogen or toxin, or a diagram of a controlled piece of equipment
- Some types of genomic data, specifically DNA sequence that could be used to identify an individual
- Records that include sensitive health information, including sexually transmitted diseases (including AIDs or HIV test results), mental health and alcohol and drug use counseling and treatment
What is the pilot?
The Technology Review pilot is intended to support ongoing evaluation and process improvement over the next several months.
- Technology Review questions have been moved to a different section of the IRB form to help more accurately determine if a review is required.
- A Technology Review intake form has been added to capture key details needed for the review. After the form is submitted, a reviewer will contact the study team with next steps or any requests for additional information.
Study teams are encouraged to start a Technology Review early to avoid delays. You may contact the Compliance Office for compliance navigation support, including guidance on pre-approved systems or technology options to consider during the study design phase.