Paper-based Data Storage and Disposal
When used, paper-based questionnaires are often saved during the data entry phase and initial data analysis phase for verification of survey responses. However, such verification should be addressed as soon as possible alongside data entry. Double-data entry, with paper-based verification of discrepant responses, yields nearly perfect correspondence between responses and keypunched data and should be required of all quantitative surveys. Once data entry and verification of survey responses has been completed, all the paper-based questionnaires should be immediately and securely destroyed (shredded or burned depending on local resources). When applicable, contractors should determine if other documents (informed consents, other documentation verifying how study protocols were implemented, etc.) should be scanned and stored digitally before destroying paper-based versions. Disposal notification is included as a final deliverable of the contract.
Digital Data Storage and Disposal
Once data are entered, there should be specific practices in place to protect data confidentiality and integrity while the data is stored digitally, such as: encrypting data files; employing password protection on data systems and data encryption; and requiring relevant stakeholders to sign non-disclosure agreements. As per MCC information technology standards, the end point encryption software should meet AES-256 encryption standards or above.
As discussed in Section 3.3, once a data handler’s role is completed, the data handler is required to ensure appropriate disposal of the digital data. To prevent unintentional release, the contractor must provide media sanitization procedures for the clearing or purging of all media that holds or has held relevant PII data in accordance with NIST SP 800-88, Guidelines for Media Sanitization[[https://www.nist.gov/publications/nist-special-publication-800-88-revision-1-guidelines-media-sanitization]]. Overwriting media by a US Government approved technology, method, or tool is acceptable. Sanitization procedures will need to be approved by MCC. The contractor must provide written attestation to MCC by contract closure of the media sanitization for any PII data generated.
Digital Data Transfer
When sharing data files, data handlers should use a secure file transfer (SFTP) system and should control access to the storage mechanism. The following techniques should be considered:
- Encrypt all communication channels, especially over Wi-Fi connections;
- Limit Wi-Fi connections to trusted parties; avoid public locations, if possible;
- File transfers should occur only through HTTPS connections;
- Use of hyperlinks for connections should be prohibited; instead, users should only connect to trusted sites by manually starting a new web-browsing session; and
- As a last resort, password protect and encrypt all PDFs or other document types if there are no other solutions available for secure file transfers. Send passwords via a separate email or phone the recipient.