Data Stored on an External Hard Drive. All requests for data must include the following information.

Transcription

1 Attachment A Form to Describe Sensitive Data Security Plan for the Use of Sensitive Data from the National Longitudinal Study of Adolescent to Adult Health Data Stored on an External Hard Drive All requests for data must include the following information. I. General Information 1. List below the name(s) and responsibilities of the investigator(s) and the research staff (students, research assistants, and programmers) who will have access to the data. *** Changes in personnel require that this information be updated. 2. PI Institution: 3. PI contact information: Name: Phone number: 4. System Administrator contact information: Name: Phone number: 5. Each project participant and system administrator must sign a separate security pledge to be included with the contract. As new personnel are added during the period of this contract, an amended Attachment C and new security pledges must be obtained and sent to Add Health. Number of security pledges included: 6. Only one complete copy of the Add Health data is permitted; however, time-delimited temporary data analysis files may be created. Temporary data analysis file(s) must be deleted every six months and recreated, as necessary, to complete analysis. Temporary data analysis files should be deleted upon completion of a project. All temporary data analysis files will be deleted in these two months each year: and month month 1

2 (Page 2 of 6) 4. Add Health data, including temporary data analysis files or subsets of the data, may not be copied to other media such as CDs, flash drives, or the hard drive of the computer. All Add Health data must remain in the same secure location as the one copy of the original Add Health data. II. Detailed description of computer system where data will be stored and analyzed 1. Please tell us about the computer you are using to access the Add Health data that is stored on the External Hard Drive: brand/make model laptop see #2 or desktop (e.g., Dell, Mac, etc.) (e.g., Optiplex, Dimension, imac Pro, MacBook Air, etc.) 2. Laptop computers are required to be secured to a desk by a lock and cable while accessing the Add Health data. I am using a laptop computer and agree to this condition. 3. Please tell us about the operating system (OS) you are using: ( build might be Home, Pro, Education, Enterprise, El Capitan, Sierra, High Sierra, etc.) name of OS version of OS build of OS 4. Please describe the external hard drive that will be used: Note: The external hard drive must have an external power source (i.e., it must be plugged into a power socket/outlet), be considered a desktop model (i.e., not portable), and be at least deep, 5 high, and 6.5 wide. make & model vendor s specifications for power type and dimensions or note that you are sending pictures of the EHD. 5. What is the physical location where you will be working when accessing the Add Health data? Street Address Type of Building (e.g., private home, apartment complex, business office, campus office, etc.) Office or Room Description (e.g., private locked room, home office, keyed entry, card swipe entry, roommate, officemate, etc.) 6. Add Health data must be excluded from the backup routine.

3 (Page 3 of 6) 7. Add Health encourages researchers to back up their program code and documentation to a secondary source that may be removed from the office (e.g., a flash drive). I understand that I may and should back up my program code and documentation. 8. Who has physical access to the equipment? 9. Who has permission to use the equipment? 10. Is the equipment used by other projects? 11. Where will hard copy information be printed? 12. How will the printed hard copy information be handled/stored/discarded? The following protocols are required. Please initial each to acknowledge your agreement. All printed copies of data output will be contained in a labeled folder. When not in use, paper copies will be stored in a locked filing cabinet. When printouts are no longer being used by researchers, they will be shredded. 13. What is the secure storage location of the original data CD? Street Address Building Room # Storage Unit (e.g., locked drawer, or locked cabinet, or safe)

4 (Page 4 of 6) 14. What is the secure storage location of the external hard drive? Street Address Building Room # Storage Unit (e.g., locked drawer, or locked cabinet, or safe) III. Security system to prevent unauthorized access to the data The following are minimum steps that should be taken to secure both the external hard drive on which the Add Health data is stored and the computer(s) used to access the Add Health data from that external hard drive. Please indicate below each security step whether you have implemented the protocol. Please write a short explanation if you cannot implement a specific step. A. Physical Security of an External Hard Drive 1. The external hard drive will be connected only to a computer that is located in a private office. 2. I enabled encryption on the external hard drive containing secure data. Preferred: Whole Disk Encryption using this software: (e.g., Bitlocker, Veracrypt) Acceptable: Folder Encryption using this software: (e.g., EFS, Veracrypt) 3. I created separate directories on the external hard drive for the Add Health data and the program code and documentation to facilitate ease of backing up the program code and documentation.

5 (Page 5 of 6) 4. Secure erasure must be run on free space periodically (e.g. monthly) and after the secure data has been removed from the external hard drive at the end of the contract period. I will run secure erasure on the external hard drive monthly and at end of contract. 5. I installed secure erasure software on the computer to which the external hard drive is connected. Name of monthly secure erasure software: Name of end-of-contract secure erasure software: 6. I will never connect the external hard drive to the computer while the network cable is plugged into the computer or while WiFi is enabled. 7. I will place the external hard drive on which the Add Health data resides in a locked cabinet, drawer, or safe when not in use. 8. I will not move the external hard drive from the use and storage location(s) specified above in questions II.5 and II.14 (e.g., will not move it between office and home). B. Controlling Access to the Data 1. Access to the Add Health data must be restricted to project personnel using the security features available via the operating system (e.g., login via userid/password and NTFS permissions in Windows, ACLs in Linux and Macintosh Systems).

6 (Page 6 of 6) 2. Add Health requires passwords of at least 16 characters. 3. Add Health requires that the screen saver activates after 3 minutes of inactivity and requires a password to log back in. 4. I will not leave my computer and external hard drive unattended while the external hard drive is attached. 5. I installed and enabled whole disk encryption software on the local hard drive of the computer to which the external hard drive is connected. Name of encryption software: (e.g., Bitlocker, Veracrypt) 6. I configured my statistical applications to point the temporary working files to the encrypted Add Health data directory on the external hard drive. Location [i.e., drive and pathname] of secured directory: 7. I will not copy or move the Add Health data out of the secured directory on the external hard drive for any reason. System Administrator I acknowledge that I consulted with the Investigator (PI). System Administrator initials I acknowledge that I completed these Security Protocols. System Administrator initials