1. Data Security Survival Skills for 21 st Century Evaluators Teresa Doksum & Sean Owen October 17, 2013

2. Abt Associates | pg 2 Why Security is so Important Increase # of places that collect (and have lost!!) our private information Increase amount of personal identity or medical identity theft Increase in penalties for losing our information (e.g., HIPAA, FERPA) 1.Penalties for losing data, even if not misused 2.Penalties for failing to destroy once no longer needed = Culture of accountability and responsibility Abt Associates ISIS Data Security Refresher

3. Abt Associates | pg 3 Responsibility of Evaluators  Understand regulations  Protect confidentiality as promised  Report security incidents  Maintain the trust of evaluation participants Abt Associates ISIS Data Security Refresher

4. Abt Associates | pg 4 Common Security Regulations Regulation Type of dataLink Health Insurance Portability and Accountability Act (HIPAA) Individual health information (e.g., medical records) http://www.hhs.gov/ocr/privacy/hipa a/understanding/special/research/in dex.html Family Educational Rights and Privacy Act ( FERPA) Public school records http://www2.ed.gov/policy/gen/guid /fpco/index.html Privacy Act of 1974 Data collected by or on behalf of federal agencies https://www.federalregister.gov/articl es/2013/09/11/2013-22072/privacy- act-of-1974-systems-of-records Human subjects regulations Data from human subjects research http://www.hhs.gov/ohrp/humansub jects/guidance/45cfr46.html State/local laws e.g., social security #s

5. Abt Associates | pg 5 HIPAA and Breach Penalties Breach per HIPAA=unauthorized acquisition, access, use, or disclosure of protected health information which compromises the security or privacy of such information… Penalties Notify individuals affected Fines paid to government up to $1.5 million If > 500 individuals affected: Mandatory media notification and…

6. Abt Associates | pg 6 HIPAA Breach Penalties, cont. Website posting on the “HIPAA Wall of Shame” http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule /breachtool.html http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule /breachtool.html “HIPAA Wall of Shame” has 682 breaches reported since Sept 2009 Name of Covered EntityState Business Associate Involved Individuals AffectedType of Breach Location of Breached Information Milford Regional Medical CenterMA19,750Improper Disposal Paper Center for NeurosciencesAZ1,101Theft Laptop TRICAREVASAIC 4,901,432 Loss Backup Tapes Educators Mutual Insurance Association of Utah UTHealth Behavior Innovations5,700Theft CDs

7. Abt Associates | pg 7 FERPA (Family Educational Rights and Privacy Act)  Protects student education records  Requires destruction of personally identifiable information (PII) once no longer needed for study  Requires written agreements to obtain and protect data (“data use agreement”)  Penalty: denied access to student data for 5+ years

8. Abt Associates | pg 8 Data Security Plan Survival Guide

9. Abt Associates | pg 9 Classify Sensitivity of Data C. Sensitive Info Financial information (income, credit reports) Alcohol abuse Substance abuse Public assistance (e.g., SNAP, TANF, unemployment benefits) Health/mental health symptoms, conditions, disabilities Criminal behavior Sexual risk behaviors, reproductive history, family planning practices Opinions about program, employer that could jeopardize employment/benefits A. Common direct identifiers First + last name Social security numbers Contact info (email, cell #, address) Health plan #, Medicaid #, Medicare # B. Unique Participant ID A or (A + C) = Use security procedures C or (B + C) = de-identified sensitive info

10. Abt Associates | pg 10 Protect Data throughout Data Lifecycle Store Analyze/ Report Transport Archive/ Destroy Archive/ Destroy Collect

11. Abt Associates | pg 11 Data Security Plan Overview: Recipe to Protect Data Throughout Data Lifecycle Worksheet/Section 1 Data Security Contact Information Worksheet/Section 2 Evaluation Information Worksheet/Section 3 Description of Study Data & Study Security Procedures Worksheet/Section 4 Staff Training on Data Security & Monitoring Worksheet/Section 5 Deliverables Worksheet/Section 6 Physical Record Lifecycle Worksheet/Section 7 Electronic Record Lifecycle

12. Abt Associates | pg 12 Questions?

13. Abt Associates | pg 13 Outcomes at Abt After Using Data Security Plans  Increased staff understanding of and adherence to data security procedures for handling data  Compliance with regulations  Reduction of minor and major security incidents  Protection of data of evaluation participants  Positive feedback from clients

14. Abt Associates | pg 14 Contact Information  Sean Owen –Sean_Owen@abtassoc.comSean_Owen@abtassoc.com –301-347-5734  Teresa Doksum –Teresa_Doksum@abtassoc.comTeresa_Doksum@abtassoc.com –617-349-2896