Office for Protection of Human Subjects

Attachment B—Human Subject Research Conducted Online
Complete only if any part of your research activities will be conducted online.

1.  Will data be collected via email?    Yes [ ]		No [ X]

If yes, describe how subjects will be informed that transmission of data via email is not secure, so confidentiality of data cannot be expected.  

2.  Will data be collected online through a means other than email?     Yes [X ]		No [ ]

If yes, answer questions 3a-b (see Minimum Guidelines):

a)	Describe how the data transmitted over computer networks is encrypted to safeguard against data interception.  Note: Most online survey companies (e.g., SurveyMonkey.com) have data safeguard policies available on their websites which describe specific safety features, such as encryption.

	From: 	  justin@sona-systems.com
	Subject: 	Re: Data Communication encryption question
	Date: 	November 17, 2007 4:07:12 AM PST
	To: 	  jsulleng@uoregon.edu
	Reply-To: 	  support@sona-systems.com

Hi Jeremiah,

Our software complies with the HIPAA Security rules, and under those
guidelines, encryption is not mandatory. In the case of our software,
since the entire database does not travel to the user (nor is it stored on
their local machine), then the only risk is data that is in-transit, and
only the limited data that that particular user is accessing. This is
generally not seen as high-risk such that encryption is mandatory.

Regards,
Justin

b)	Are subjects encouraged or required to use a specific type or version of browser software?     Yes [ ]		No [X ]

If yes, provide a rationale:

3.  Will a survey server be used?   Yes [X ]	No [ ]	If yes, complete questions 4.a-c.

Check which type of server will be used.   UO server  [ ]	Private server  [X ]

a)	Describe how the server is administered including name of company, if applicable.

Sona-Systems: maintains the software and administers the servers. www.sona-systems.com

b)	Describe the safeguards for accessing the online survey.  For example, what is the validation and authentication process to prevent redirecting of the study information?  Will subjects be given a password in the recruitment process to access the survey through a secure link (https)?

Researchers, Professors, Administrative staff and Subjects are all required to give a username and password each time they access the software. Sona-systems restricts access to information based on the roles defined above. Providing access only to the data necessary for fulfilling the role.

4.  Will data be stored on a server?    Yes [X ]	No [ ]	If yes, complete questions 5.a-e.

a)	Check which type of server will be used.   UO server  [ ]	Private server [X ]

b)	Describe how personally identifiable information and IP addresses will be kept separate from data.

from sona-systems website: http://www.sona-systems.com/compliance.asp

The system can be configured so students are only identified to researchers with a unique, numeric identity code to protect their privacy. Students never see a list of who else has signed up for a study. 

c)	Describe how the data will be encrypted.

from Sona-systems: http://www.sona-systems.com/compliance.asp

 Our software fully complies with all current HIPAA regulations, as well as the Common Rule (45 CFR 46) regarding human subject research.

d)	Describe the storage of backup data.

From Sona-sytems website: http://www.sona-systems.com/Product.asp#Features

We use only enterprise-grade IBM Netfinity and Dell PowerEdge servers for our customers. All our servers have redundant processors, hard drives, and network connections, to reduce the chance of failure. On a typical day during the school year, our servers process more than 5 million transactions throughout the day. Our servers are located in secure datacenters in Washington, DC and Toronto (Canada), and both datacenters are staffed around the clock. Data is backed up nightly and the backups are stored at the datacenter and also at an off-site location.

e)	Describe the disposal of data from the server.  

from Sona-systems: http://www.sona-systems.com/compliance.asp

 Our software fully complies with all current HIPAA regulations, as well as the Common Rule (45 CFR 46) regarding human subject research.