DATA SECURITY CHECKLIST FOR PRINCIPAL INVESTIGATORS Syracuse VA Institutional Review Board (Syracuse , Canandaigua & Bath VAMC)

Name of Project:

MIRB#

PI Name:

PI Telephone Number:

PI Email Address:

Name of Information Security Officer (ISO):

ISO’s Phone Number and Email Address:

Instructions

Please review Helpful reminders that will achieve compliance with VA Directives before completing this checklist. If you answer NO to any one of the statements in Section I, you may not remove or transmit the data outside the VA and you must consult with your supervisor, ISO and Privacy Officer. If the research will not obtain any VA sensitive information/data the statements below should be marked as not applicable (N/A).

I.

YES	NO	N/A	Specific Requirement
1. All VA sensitive research information is used and stored within the VA
2. All copies of VA sensitive research information are used and remain within the VA.
If you have answered yes or N/A to both statements above, continue on to Section III.

II.

If the original or copies of VA research information are removed from the VA the following apply:
YES	NO	N/A	Specific Requirement
1. Permission to remove the data has been obtained from 1) your immediate supervisor. 2) your ACOS/R&D. 3) the VA Information Security Officer (ISO), and 4) the VA Privacy Officer.
2. A property pass for the equipment (Laptop etc.) has been obtained.
3. The laptop or other portable media is encrypted and password protected. Note: Contact the VA ISO at your facility for encryption issues.
4. Names, addresses, and Social Security Numbers (real and scrambled) have been replaced with a code. Note: Names, addresses, and Social Security Numbers (real or scrambled) may only be maintained on a VA server and documentation of the procedure by which the data were coded must remain within the VA.
5. Data sent via mail or delivery service have been encrypted. Note: It is preferable to send data on CDs or other media by a delivery service where there is a “chain of custody”.
6. For data that will reside on a non-VA server: The server has to be certified and accredited as required by Federal Information and Security Management Act of 2002 (FISMA). Note: your facilities ISO should be consulted.
7. Access to the data is only by those who are authorized to access it and the access is related to VA-approved research.
8. Procedures for reporting theft or loss of sensitive data or the media such as a laptop, containing sensitive data are in place and familiar to the research and all others who have access to, use, store, or transport the data.

III.

PROJECT INFORMATION: Assessment of Security VA Data *Investigators who plan to transport data outside the VA (even between VAs) must complete a data transport agreement. There may also be times (other than transport outside the VA) when a data transfer agreement is appropriate. Please discuss this with the ISO.
INTERNAL USAGE / TRANSMISSION OF DATA
1. How do you store your identifiable VA data: e.g. on hard drives, mobile computers (laptops), memory sticks, ZIP drives, JAZZ, other media? If in locked cabinets, who has keys? If stored electronically on a server, where and under what security?
2. How are identifiable data transferred/transmitted (e.g. If sent electronically, indicate what level of encryption is used, if any. If the data are on paper forms, are they sent via campus mail, etc)?
EXTERNAL USAGE / TRANSMISSION OF DATA
3. What identifiable data (e.g. name, social security #, date of birth) has been/is being/will be disclosed outside the VA(e.g. kept on personal computers, sent to co-investigators, statisticians, funding agencies, contractors, companies).. To what extent are identifiers removed? How are the data used? Is this disclosure included in the informed consent?
4. How are identifiable data transferred/transmitted (e.g. If sent electronically, indicate what level of encryption is used, if any. If the data are on paper forms, are they sent via campus mail, etc)?
5. How is identifiable data stored outside the VA? (e.g. If in locked cabinets, who has keys? If stored electronically on a server, where and under what security?)
6. When the study is completed, how will the identifiable data shared outside the VA be destroyed or will it be returned to the VA? ( Note the VA has a program for destroying data on HARD DRIVE / MEDIA. Give devices to the ISO)
7. If you have identified potential vunerabilities, how will they be addressed?

IV.

Helpful reminders that will achieve compliance with VA Directives
YES	NO	N/A	Specific Reminder
Information Security Training: All study staff are up-to-date with VA Privacy and Information Security and Rules of Behavior training.
Software: The study identifies specially obtained software that will be used, the source of the software, whether a license will be required, who will fund the license as well as any data that will be stored in temporary files on the computer’s hard drive.
Web Applications: The study identifies any web application, as well as its security features, that will be used for such purposes as recruiting subjects, completing questionnaires or processing data.
Data Flow: The study includes a description of the data collection, data flow and/or data management process that will be used during the course of the study.
Data Security Plan: Study describes how electronic data as well as paper records will be secured.
Data on a Hard Drive: The study identifies whether VA research data will be stored on the hard drive of a PC. If so, it is considered VA best practice to encrypt the PC. (Ref: VHA Handbook
Mobile Devices: The study states that all mobile devices will be encrypted and that the encryption is FIPS 140-2 validated. Note: All mobile/portable devices and media and any information transmitted to and from a wireless device must be protected with VA approved encryption technology that is FIPS 140-2 validated.
Storage Location: The study identifies precisely where data and specimens will be stored, i.e. physical site, network location/server name (e.g. vhacbarsch), type of mobile storage device, building and room, etc.
Removal of VA Sensitive Information from the VA Protected Environment: The study states whether or not research data is intended to be removed from the VA protected environment.
Protection of Media Stored at Alternate Site: If the study team plans to store VA sensitive information outside the VA protected environment, the study indicates by what method it will be protected.
Data Transmission: The study states how sensitive electronic information will be securely transmitted. Note: VA sensitive data or information may only be transmitted using VA-approved solutions such as FIPS 140-2 validated encryption.
Data Backup: The study indicates that mobile storage devices do not contain the only copy of research information. Original electronic VA research data stored on a mobile device or outside the VA protected environment will be backed up regularly and stored securely within VA’s protected environment.
Shipping Data: Study indicates whether sensitive research data that must be sent via common carrier will be encrypted with FIPS 140-2 validated encryption if it is electronic and will be sent via delivery service with a chain of custody.
Data Return: The study includes a statement regarding what VA information will be returned to the VA, how the information will be returned to the VA, or plans for its destruction.
Data Destruction: The study includes a description of the methods that will be used to destroy data at the end of its life cycle.
Termination of Data Access: The study states that removal of access to research study data will be accomplished for study personnel when they are no longer part of the research team.

V.

Principal Investigator’s Certification: Storage & Security of VA Research Information The Principal Investigator must check each box and sign and date the form.
I certify to the best of my knowledge that all VA sensitive information associated with the research study is being used, stored and secured in accordance with the applicable VA and VHA policies and guidance.
2. I further certify that I have read and understand Section IV entitled Helpful reminders that will achieve compliance with VA Directives
________________________________________ __________________ Principal Investigator Signature Date

VI.

ISO REVIEW
I have reviewed the Protocol and the Data Security Checklist for the above named research protocol. I have found no issues of concern with the information disclosed unless specifically written in the comments section below.
________________________________________ ___________________ INFORMATION SECURITY OFFICER Date
Comments: