***All data must be fully de-identified before upload to any OSF project for any purpose, even if the project is never shared.***
Whether data is stored on the OSF for private use by one researcher, uploaded for study collaboration, or placed there for public access, the data must first be fully de-identified by removing all direct identifiers and as many indirect identifiers as possible. Please see the de-identification summary or consult the HIPAA privacy rule directly.
BTNRH policy requires IRB approval for any data shared beyond the study PI and protocol staff. As with any other method of sharing data, before allowing access to data on an OSF project to any person or collaborator, please follow current policy for IRB approval to share data. For example, if you are using OSF to store de-identified data and it will be accessible by study collaborators, those collaborators should be added to your protocol. If granting access to anyone not on your protocol, you must submit appropriate IRB data usage agreements.
**If you are using OSF to make your study data accessible by the public, BTNRH has the following guidelines:**
1. Upload fully de-identified data to your OSF project. (see HIPAA guidelines)
2. Add your Research Compliance Analyst as a non-bibliographic administrator to the project. This is for compliance auditing purposes only. You will maintain all administrator functions and responsibilities for the project.
3. Submit appropriate change request or data sharing agreement in an email to your Research Compliance Analyst with appropriate IRB data usage agreement paperwork as well as a link to your project.
4. Your Research Compliance Analyst will verify and approve compliance of the project and IRB paperwork.
5. Once you have approval or signed agreement, make a registration of the project. This prevents any future changes to the data stored on the project.
6. Set the privacy setting of the registered project to allow public access.
If there is a need to make the project public in an editable format instead of a registration, please make note of this in your email to your Research Compliance Analyst. Projects made public in editable form will need approval and will be regularly checked for compliance with the HIPAA privacy rule. If using a platform other than OSF for storing data, your Research Compliance Analyst should be consulted.
