Data Security

Legal Background

Rather than a single, comprehensive law, a number of federal laws and regulations govern research involving human subjects in the United States. Although some of these may overlap, dovetail, or contradict one another, their underlying goal is to protect the privacy of research participants. This section discusses just a few of these laws and regulations.

In 1979, the Belmont Report, written by the National Commission for the Protection of Human Subjects of Biomedical and Behavioral Research, proposed the need for privacy protection. This report states that privacy of research participants should be protected to honor basic ethical principles. As a result of this report, several federal regulations and guidelines have been enacted.

In 1981, the U.S. Department of Health and Human Services established the Federal Policy for the Protection of Human Subjects (Title 45 C.F.R. § 46, the Common Rule). The Common Rule requires all research involving human subjects to have sound plans and obtain written informed consent from the subjects to minimize any risk to them. The policy also stipulates that the research plan must receive ethics approval from an institutional review board (IRB).

Personal data pertaining to food, drug, cosmetic, and clinical investigations are protected through the Food and Drug Administration’s (FDA) Protection of Human Subjects Regulations (Title 21 C.F.R. §§ 16, 50 and 65). If a research project includes any FDA-regulated products, additional FDA permission may be necessary as well as IRB approval. In addition, the Health Insurance Portability and Accountability Act privacy rule (Title 45, C.F.R. §§ 160 and 164) addresses the protection of personal health information. The Privacy Rule defines “any individually identifiable health information held or transmitted by a covered entity or its business associate, in any form or media, whether electronic, paper, or oral” (Title 45 C.F.R. § 160.103) as protected health information. The Privacy Rule also mandates that research involving protected health information establish specific measures to protect this type of data. Although this mainly targets medical research, research data in other fields, depending on the type of data, are also regulated by this law.

...