University of Delaware
Toolbox

Guidance on Data Storage & Retention

Handling and Retention of Human Subjects Research Records

Records associated with human subjects research protocols approved by full-board or expedited Institutional Review Board (IRB) review are subject to University of Delaware and federal record-keeping requirements. This document is meant to serve as a guide to acceptable handling of human subjects research data.

While the Project is Active

Records for active IRB approved research projects must be stored in secure locations on campus. For research performed off-campus, the data should be secured and returned to campus as soon after collection as is practicable. Particular care should be taken to protect data on lap-top computers, external hard drives and other portable devices. Study information containing personal identifiers stored on these devices should be encrypted to prevent unintentional breaches of confidentiality in the event the storage device is lost or stolen. Similarly, paper records identifying research participants including consent forms should be kept under the personal control of the researcher. The level of protection for the data should be commensurate with the sensitivity of the data. Basic levels of storage are as follows:

Consent forms: locked in file cabinets in offices on campus. Offices should be locked when unattended. In the event that research activities are not on campus AND it is necessary to maintain the consent forms at the research site, pdf copies of the consent form should be uploaded and stored on a secure University maintained server.

Paper Data Records: locked in file cabinets in offices on campus.

Electronic Data Records: stored in password protected files, preferably on University maintained servers with regular back-up. Sensitive electronic data should be encrypted.

Audiorecordings: Digital files should be stored in protected files on University servers. Audiotapes should be securely stored in locked file cabinets on campus. Both digital audio files and tapes should be deleted as soon as they are transcribed and no longer required for research purposes.

Videorecordings: Digital files should be stored in protected files on University servers. Videotapes should be securely stored in locked file cabinets on campus.

Record Retention at the End of a Project

Compliance with 45 CFR 46.115(b) requires that all records relating to IRB approved research be retained for 3 years after the completion of the project. Records may be preserved in hard-copy, electronic or other media form, and must be accessible for audit purposes. Records for completed projects should be stored in secure locations on campus with the same care used when the project was active.

If a researcher (faculty, staff or student) leaves UD, a copy of the research records must remain on campus. Students should coordinate storage of research records with their faculty advisors and/or departments. In the event that the advisor or department is unable to retain the records, the records should be sent to the IRB office for secure storage in University Archives. Copies of all human subjects research records for faculty and staff leaving the University should similarly be sent to the IRB office for secure storage in University Archives. Records sent to archives will be recalled only in the event of an audit requirement, and will be destroyed at the end of the 3 year retention period.

Destruction of Records

Destruction of human subjects research records should be performed in a fashion that protects the confidentiality of the research subjects. It is recommended that paper records be shredded, that physical tapes (audio and video) be erased and physically destroyed, and that electronic media used to store data be scrubbed after the files are deleted.

Data is considered to be completely de-identified when ALL links between individual identity and the data are destroyed (not even the original researcher is able to associate data with individual research subjects). If files contain information that might identify the participants such as date of birth, zip code, etc., it is not considered de-identified simply because names have been removed. Researchers may retain de-identified data for future use if that use was specified in the original research consent. Such future use does not meet the definition of engagement of human subjects in research and is not subject to further IRB review.

For further guidance, please contact the IRB Office at 302-831-2137.