Enterprise Research Data Security Plan (ERDSP)
This form must be completed and attached to all initial submissions and to any modifications that affect the study’s data and security plan.
ORD has mandated that Information Security Officers use the ERDSP (accessible only behind the VA firewall) to facilitate protocol reviews. Once you select the Purpose of Submission, the form will branch out with questions and will continue to branch based on your responses. Refer to ERDSP Guide and FAQs for further information.
If you plan to share VA research data (electronic and/or hard copy) with another VA or non-VA entity/institution, refer to the VA Data Transfer Methods Table for VA-approved methods for secure data transfer.
VA Form 10-250 (required by VHA Directive 1605.03
This form must be completed and attached to all initial submissions as well as to any modification that result in changes to: data collection/use/storage/transmission/disposition, VA informed consent, VA HIPAA Authorization form, Data Use Agreement (DUA), or when the modification impacts waiver of HIPAA Authorization.
Complete the Study Information section (Page 1 only) of the VA Form 10-250 and upload in IRBNet. Include all relevant information in the Study Application for consistency.
Unless it’s determined that Privacy Officer review is not required, the VA Privacy Officer will email a signed copy of the form to the study team documenting the final privacy review. Please visit this website for more information about VA Privacy requirements (only accessible behind VA firewall).
VA HIPAA
Authorization for Use & Release of Protected Health Information for Research Form 10-0493 This pdf works best with Internet Explorer. The VA HIPAA form must be used when written HIPAA authorization is required for a VA study. If you have questions, contact the VA Privacy Officer at VHABIRPrivacyFOIAOfficers@va.gov.
Required VA records retention language
Include the following statement verbatim in the Confidentiality section of the Study Application: VA research records will be retained and disposed in accordance with the VHA Records Control Schedule (RCS 10-1).
Refer to VHA Records Control Schedule (RCS 10-1) Section 8300.6 Research Investigator Files for VA research records maintenance. Contact the Research Office for assistance with off-site records storage.
Required 38 USC 7332 language
38 U.S.C. Section 7332 makes all VA records that contain the identity, diagnosis, prognosis or treatment of VA patients or research subjects for drug abuse, alcoholism or alcohol abuse, infection with human immunodeficiency virus (HIV/AIDS), or Sickle Cell Anemia strictly confidential. This statute applies to information regardless of whether it is recorded in a document or a Department record.
If a study collects or uses individually identifiable patient health information covered under 38 U.S.C. 7332 (DRUG, ALCOHOL, HIV AND SICKLE CELL ANEMIA INFORMATION), include the following statement verbatim in the Study Application:
This study includes collection of information covered under 38 U.S.C. 7332 (drug, alcohol, HIV and/or sickle cell information). The purpose of the data is to conduct scientific research. No personnel involved in the study will identify, directly or indirectly, any individual patient or subject in any report of such research, e.g. manuscript or publication.
For additional guidance, refer to ORPP&E’s Research Information Security & Cybersecurity Toolkit.
External disclosure of patient information for non-VA research (Form 10-5345 required)
If VA staff will obtain VA patients’ contact information from the VA medical record and provide it to UAB staff (e.g., for recruitment into a non-VA study), this is considered an external disclosure which requires the VA patient’s signed authorization. This disclosure of identifiable information must be documented using VA Form 10-5345 (Release of Information Form).
The 10-5345 must be collected by the VA employee and sent to HIMS for scanning into the patients’ medical records. Information may be pre-filled for the patient (except for the section related to authorizing disclosure of 7332-protected information), then the patient must review and sign it. Electronic signatures are not accepted. The 10-5345 must be filled out completely to be valid. If you plan to pre-fill the form for patients, the Privacy Officer must review the form prior to use. Email the pre-filled form to VHABIRPrivacyFOIAOfficers@va.gov for review.
Reporting Privacy and Information Security Incidents
To report privacy incidents, email the VA Privacy Office at VHABIRPrivacyFOIAOfficers@va.gov.
To report data security incidents, email the VA Information Security Office at oitdsoesoareabirminghamissos@va.gov.
Certificates of Confidentiality
When requesting a Certificate of Confidentiality, you may find more details about how to respond to the specific sections of the request here. Further questions should be directed to the NIH CoC Coordinator at NIH-CoC-Coordinator@mail.nih.gov