Skip to main content

WVU Research - Data Protection Certification

WVU Research Data Protection Process - REQUIRED ON 10/11/21

To facilitate faster approvals for data agreements and IRB protocols and to strengthen compliance for collecting and using data for research, WVU is introducing a process for Data Protection for projects that will submit a human subjects protocol to the IRB (all protocol types, including NHSR) and for requesting human subjects Data Use Agreements from WVU OSP.  

The Data Protection Request Form replaces the Data Intake Form.

The Data Protection Request Form is required for ALL INITIAL and NEW Protocols - This includes expired protocols that are entered as new.

Submit a WVU Research - Data Protection Request Form

Modify a Submitted Data Protection Form

The process will be introduced using a phased approach: 
Pilot Phase: 9/13/21 to 9/27/21 - Complete
Beta Test (Soft Go-Live): 10/11/21 to 12/3/21
Go-Live: 12/5/21

Click on the button above to complete the Data Protection Request Form. Question by Question guidance is provided within the form and here. After you submit the form, you will either receive a Low Risk Data Protection Certificate within minutes or emails indicated subsequent required approvals. Click here to view a SAMPLE DATA PROTECTION CERTIFICATE.  After approvals are complete, you will be emailed a Medium or High Risk Data Protection Certificate. 

How the process works:

Researchers complete a Data Protection Request Form (formally the Data Intake Form), depending on the request and risk related to the data, the submitter will receive a Data Protection Certificate within minutes or within 2-5 days.  Other approvals may be needed, the only potential significant delay in receiving a DP Certificate is when University standard data storage plans cannot be used.

Approval Time
Data Description

DP Certificates 

Automatically emailed to the submitter within minutes.
Applies to: fully de-identified healthcare data and data collected anonymously, data from public sources and data from sources with no identifiers.  Click here for a list of identifiers.
DP Certificates

Automatically emailed to the submitter within minutes IF standard storage plans can be used.
Applies to:  Data that includes identifiers that are not considered HIPAA-PHI. Click here for a list of identifiers

If the approved storage plan can NOT be used, additional steps and approvals are required, the Data Protection Certificate will be emailed after approval. Approvals could take 2-4 weeks depending on the request.

DP Certificates
(HIPAA- PHI/Sensitive Data)

NOT Automatically emailed within minutes.  (2-5 Days for medical/dental record access and storage plan review) 
Applies to: Data that includes identifiers from WVU medical/dental records, HSC repositories and other data considered sensitive under University policy.

Approvals may take 2-5 business days depending on the request. 

The process will provide researchers with:
  • The classification of risk for the data to be used and stored in support of the research
  • The WVU ITS/WVU-HSC ITS approved storage plan(s) for the data
  • The WVU ITS/WVU-HSC ITS approved software and communications products
  • The WVU approved participant payment methods
  • HIPAA approval and institutional review of requirements for PHI
The process will automatically notify the correct departments for:
  • The Office of Export Control for requirements related to international research components
  • The Office of Sponsored Programs to begin the Data Use Agreement process
  • Others related to the approval of new software, services, or participant payment methods

Changes to Approved Forms:

If data requirements change after the DP Certificate is received, a new form must be submitted reflecting the change (research project personnel, data source, data variables). Research projects using High Risk data must report all changes in Research Personnel.  Click on the link above for instructions on how to easily submit a change.


  • During the BETA TEST phase, the researcher completes the form BEFORE starting an INITIAL protocol submission or requesting a Data Agreement from OSP. 
  • The researcher will receive the Data Protection Certificate even if approvals are needed for software, payment methods and international components. 
  • The researcher will attach the Data Protection Certificate to the INITIAL protocol submission. Attaching approvals related to software and participant payment products/services to the protocol is not required. 
  • If a Data Agreement is needed, the researcher will be contacted by OSP 1-3 days after submitting the form. The process to create and obtain approval for the Data Agreement will begin then. 
  • Requests for WVU Medical/Dental records and HSC repository data can from 2-6 days to be reviewed and approved, please plan accordingly. 
  • If the standard University Data Storage Plans cannot be used, the Data Protection Certificate could be delayed for two or more weeks, please plan accordingly.