Section XII:

Safeguarding Confidentiality and Records

WPP #: XII-1

Title 1:

General Safeguards and Investigator Records Retention

Effective Date:


Revision History:

06-07-04; 06-21-06; 09-1-09

Policy Statement

The principal investigator and all research staff are required to protect the confidentiality of research subjects and all research records, including maintaining appropriate research records. Additionally, investigators must retain records per federal regulations, ICH GCP Guidelines and VCU policy.

Description and Procedures

  1. Protection of Confidentiality:

    An issue of primary importance is the protection of confidentiality and security of research records. Particularly in research involving sensitive medical conditions or behaviors, the investigator must have sound plans to protect the subject's identity as well as the confidentiality of the research records. Confidentiality must be expanded to all types of data collected, including personality inventories, interviews, questionnaires, or the use of observation, photographs and film, taped records, as well as other stored data. Care should be taken to explain the methods that have been devised to protect all data, and especially data with potential to expose subjects to additional risk. For example, methods could include the use of numbering or code systems safely locked files in private offices, use of encryption, password protection, and limited data access are examples of methods to be considered by the PI in order to protect sensitive research data. Increasing use of data collection via the Internet and maintenance of electronic data files highlights the urgency to separate direct identifiers from collected data. Obtaining a Certificate of Confidentiality may also be indicated for research involving legally-sensitive data (see WPP XII-2 Certificate of Confidentiality).

    Furthermore, the investigator should describe who has access to the data and under what circumstances a code system may be broken. Without appropriate safeguards, problems may arise from long-term retention of records. In special circumstances requiring additional safeguards to prevent potential criminal prosecution of the participating human subject, the IRB may require the destruction of all data that can identify the subjects.

    A special situation arises for video or taped data and photographs since these media provide additional potential means for subject identification. Investigators must secure subject consent explicitly mentioning these practices. They should also explain plans for final disposition or destruction of such records.

  2. Investigator Record Retention:

    At a minimum, all investigator records pertaining to human subjects must be retained during the entire IRB approval period unless otherwise approved by the IRB. Where research is regulated by the Food and Drug Administration (FDA), investigators records must be retained in accordance with the International Conference on Harmonization (ICH) Good Clinical Practice (GCP) Guidelines Section 4.9.

  3. VCU Policy Notes on Records Retention:

    In accordance with the Research Data Ownership, Retention, Access and Security the Principal Investigator of each research program must ensure that research data documenting the methods and accuracy of data collection and interpretation is retained. Research data disclosed or referenced in publications, including the primary experimental results, must be retained for a minimum of five (5) years (or as otherwise defined by state regulations or agreement) to allow analysis and replication by others. Research Data resulting from sponsored programs are to be retained for a minimum of five (5) years after submission of the final Report on the research project, unless a longer retention period is specified by the sponsor. Research data collected for product application to the Food & Drug Administration (FDA) may be subject to additional data retention requirements as specified by the sponsor and/or the FDA.

    If an investigation, legal action or official inquiry concerning a research activity is ongoing; all research data related to the project must be retained and made accessible until all issues are resolved.

    In addition to the 5 year retention requirement above, if a student or trainee is involved, research data must be retained at least until the degree is awarded to the student, the training period is complete, or it is clear that the student has abandoned the work. Research Data should be kept for as long as may be required to protect any patents or other intellectual properties resulting from this work.

    This policy does not create an obligation to retain research data ensuing from an abandoned or unfunded project, unless it results in a report in which the investigator is identified as a University member, constitutes a record of University intellectual property, or involves the use of animal or human subjects.


ICH GCP Guidelines
Research Data Ownership, Retention, Access and Security
VCU IRB WPP XII-2 Certificate of Confidentiality