Institutional Review Board		                                               		CSAB 138 
University of South Alabama		        		              Telephone: 251-460-6308
							                           FAX: 251-461-1595
  Research Database Registration Form
Note:  This form applies to databases that are developed and/or used exclusively for
research or recruitment purposes and not for patient care.

IRB Project Title:       						

Registration: Type (check one)
	Initial database registration
Principal Investigator:               							Database information update

1.	Database name: For registration purposes, please name the database.       

2.	Database custodian:  For registration purposes, please designate a custodian who will be accountable for research uses of the database.  
	Name:       
	Email:       
	Phone Number:      

3.	Is this database being used to establish the manipulation and storage of data/specimens for the purposes of research? 
	   YES             NO

4.	Describe the type of electronic health data being stored:       

5.	Describe the physical location (building/room number) of the database:       

6.	Workstation Use - used to send, receive, store, or access electronic protected health information (“EPHI”) shall be used in a secure and appropriate manner.  To help ensure proper access and use of workstations, the following procedures shall be followed.  Please check each box to certify compliance with applicable criteria:
	Each workforce member shall be provided unique usernames and password for utilizing workstations and related information systems.  Passwords are confidential and shall not be disclosed to others;
	Workstations which are used to access and store EPHI shall be located in secure areas;
	Workstation monitors shall be positioned in a manner so as to restrict viewing to authorized personnel only;
	Active workstations shall not be left unattended for prolonged periods of time.  
	EPHI shall not be permanently stored on the local hard drive of any workstations (laptops, tablet PCs, and handheld PCs) which are not permanently assigned to a specific department or unit and secure. If a server is available, original EPHI will reside on the server and will be made available on workstation(s) via active directory controlled “network resource folders”, assigned to individual users as appropriate; 
	Where appropriate, backup of workstation data, programs, and computer systems shall be performed on a regular basis to protect against business interruption;
	At the close of business or at the end of a workforce member's utilization of a workstation, the user shall close out of application sessions and be logged off the network.

7.	Workstation Security – to ensure that all workstations and servers are secure, the following measures shall be implemented.  Please check each box to certify compliance with applicable criteria:
	Workstations that are used to store EPHI must be not be set-up in public or general access areas. 
	All unattended workstations must either be logged off or secured by a password if the user plans to be away from the workstation.
	All workstations must either have automatic log-off or automatic lock-out capabilities, as deemed appropriate by physical location security.
	User network accounts must be temporarily disabled after five (5) invalid sign-on attempts. These disabled accounts must be manually reset by the system administrator.
	EPHI must not be stored on the local hard drive of a workstation that is not permanently assigned to a specific individual and maintained in a secure location.
	All users who remove workstations or media from the organization shall take reasonable precautions to physically secure the device(s) and media.

		Other security precautions that have been implemented - explain:       

8.	Transmission Security - Research study sites shall implement measures to protect the security of EPHI when transmitted electronically from one point to another and it must be protected in a manner commensurate with the associated risk of unauthorized access.

	Do you plan to transmit EPHI by use of email or the Internet?    YES     NO  If yes, please check each box to certify compliance with applicable criteria:
	EPHI must not be transmitted over the Internet without the use of an approved encryption tool.
	Only the minimum required amount of EPHI should be transmitted electronically.
	E-mail containing EPHI should only be sent via USA Groupwise (128-bit encryption) when no other method is appropriate. 

9.	Specify how long the database will exist and how remaining data will afterwards be destroyed.  If the database will be maintained indefinitely or until the data are exhausted, then include a statement to that effect: 	     

10.	Contingency Plan -    See Attachment A.  This form needs to be completed and included with the submission of  the Research Registration Database form.  

11.	Is it practicable to obtain subject’s privacy authorization to add their data/specimens to the research database?  
	   YES	    NO

12.	Please choose one of the following:

  It is practicable to obtain subject’s permission to add data/specimens to the research database.  I will use the USA approved HIPAA subject authorization template form to seek subject’s permission.

  It is not practicable to obtain subject’s permission.  I will not add data/specimens to the database unless I have an IRB approved waiver of subject authorization to add data to the IRB approved research database.

Investigator’s Assurance:  My research team and I will comply with the use and disclosure restrictions described above and completion of a risk assessment on an annual basis.

Signature for database registration				Date

													
IRB Office Use Only:

  Approved	  Approved Pending (see comments)	  Not Approved

Comments:  

											
Reviewer’s signature					Date

ATTACHMENT A
TEMPLATE – CONTINGENCY PLAN

Date: 

Name of person completing form: 

Research Database Name: 

Software (Name and version): 

Location of the system: 

Does the system contain sensitive or critical data?      Yes      No

Purpose of the system:  

Number of Users: 

Are the backups stored off-station?    Yes       No  

If electronic (Tapes, Disks, CDs, etc.) backups are NOT stored off station, are hard copies or other storage media kept to recover information? Explain:  																											

Are there manual or electronic procedures for the “continuation of business”, if the main system goes down?  Yes   No

Procedures for “continuation of business”:
 
In the event of catastrophic events that cause major destruction to the facility or assets or events that interrupt operations but do not cause major destruction, procedures below will be followed.

Some causes include:
Fire, flood, earthquake, or other natural disaster
Power failures and fluctuations
Interference from outside electrical sources
Interruptions in gas, water, and other utilities
Mechanical failures
Sabotage
Communication failures
Accidental file over-write or deletion

Some effects/ consequences include:
Loss of vital records and data
Loss of communication systems
Possible failure of computer security programs
Inability to use critical programs
Extended periods of operating at less than normal efficiency

Procedures in event of failure: 
1)	The failure will be reported to the database manager
2)	The database manager will determine the nature of the failure
3)	Manual procedures will be instituted if necessary
4)	The database manager will work in conjunction with in-house Information Technology staff to:
(a)	Determine the extent of damage to both the hardware and software
(b)	Assist in hardware and software recovery
(c)	Secure the backup of media from storage site
(d)	Reinstall the backup media
(e)	Test the system
(f)	Reassign passwords