Skip to main content

WVU Research - Data Protection Certification

WVU Research Data Protection Process - PILOT PHASE

To facilitate faster approvals for data agreements and protocols and to strengthen compliance for collecting and using data for research, WVU is introducing a process for Data Protection for projects that will submit a human subjects protocol to the IRB (all protocol types, including NHSR) and for requesting Data Use Agreements from WVU OSP.   The Data Protection Request Form replaces the Data Intake Form.

Submit a WVU Research - Data Protection Request Form

The process will be introduced using a phased approach: 
Pilot Phase: 9/13/21 to 9/27/21 
Beta Test (Soft Go-Live): 10/11/21 to 12/3/21


Click on the button below to complete the Data Protection Request Form. Question by Question guidance is provided within the form and here. After you submit the form, you will either receive a Low Risk Data Protection Certificate within minutes or emails indicated subsequent required approvals. Click here to view a SAMPLE DATA PROTECTION CERTIFICATE.  After approvals are complete, you will be emailed a Medium or High Risk Data Protection Certificate. 


How the process works:

Researchers complete a Data Protection Request Form (formally the Data Intake Form), depending on the request and risk related to the data, the submitter will receive a Data Protection Certificate within minutes or within 2-5 days.  Other approvals may be needed, the only potential significant delay in receiving a DP Certificate is when University standard data storage plans cannot be used.


Risk
Approval Time
Data Description

LOW RISK
DP Certificates 

Automatically emailed to the submitter within minutes.
Applies to: fully de-identified healthcare data and data collected anonymously, data from public sources and data from sources with no identifiers.  Click here for a list of identifiers.
MEDIUM and HIGH RISK
DP Certificates
(Non-HIPAAA-PHI)

Automatically emailed to the submitter within minutes IF standard storage plans can be used.
Applies to:  Data that includes identifiers that are not considered HIPAA-PHI. Click here for a list of identifiers

If the approved storage plan can NOT be used, additional steps and approvals are required, the Data Protection Certificate will be emailed after approval 

PLAN ACCORDINGLY: Approvals could take up to 2- 4 weeks depending on the request.
HIGH RISK
DP Certificates
(HIPAA- PHI/Sensitive Data)

NOT Automatically emailed within minutes.  (2-5 Days for medical/dental record access and storage plan review) 
Applies to: Data that includes identifiers from WVU medical/dental records, HSC repositories and other data considered sensitive under University policy.

Approvals may take 2-5 business days depending on the request. 

PLAN ACCORDINGLY: Approvals could take up to 2- 4 weeks depending on the request.
 
The process will provide researchers with:
  • The classification of risk for the data to be used and stored in support of the research
  • The WVU ITS/WVU-HSC ITS approved storage plan(s) for the data
  • The WVU ITS/WVU-HSC ITS approved software and communications products
  • The WVU approved participant payment methods
  • HIPAA approval and institutional review of requirements for PHI
The process will automatically notify the correct departments for:
  • The Office of Export Control for requirements related to international research components
  • The Office of Sponsored Programs to begin the Data Use Agreement process
  • Others related to the approval of new software, services, or participant payment methods

During the PILOT, the researcher complete the form after submitting an INITIAL protocol and receiving an email from WVU OHRP (IRB), the applicable reviews for unapproved software, unapproved participant payment methods and international (Export Control) components will take place. 

Note that the review and approval of these items will NOT delay the delivery of an approved Data Protection Certificate. Researchers may be contacted by ITS and Research Office staff for additional information for unapproved product requests and international components. 

The researcher will receive a Data Protection Certificate that will indicate the next steps and summarize the data risk profile for the project. Researchers will be contacted by OSP regarding Data Use Agreement requirements within 1-3 business days and the Data Protection Certificate will be required for the agreement to be approved. 

The Data Protection Certificate will not be required for protocol review approval/acknowledgement during the pilot phase but will be required in the next Beta Test phase. 


During the BETA TEST phase, the researcher completes the form   BEFORE  starting an INITIAL protocol submission or requesting a Data Use Agreement from OSP. 

The same checks and approvals for unapproved software, unapproved participant payment methods, unapproved storage plans, international (Export Control) components will take place as they did during the Pilot Phase. The applicable approvals will be required and the researcher will be contacted by ITS and Research Office staff as needed. 

The researcher will receive the Data Protection Certificate even if approvals are needed for software, payment methods and international components. The researcher will attach the Data Protection Certificate and any other approval documentation/emails received to the INITIAL protocol submission. 

If a Data Use Agreement is needed, the researcher will be contacted by OSP 1-3 days after receipt of the Data Protection Certificate to proceed with the Data Use Agreement process. 

Requests for WVU Medical/Dental records and HSC repository data can from 2-6 days to be reviewed and approved, please plan accordingly. 

If the standard University Data Storage Plans cannot be used, the Data Protection Certificate could be delayed for two or more weeks, please plan accordingly.