Research Data and Information Security

The investigator prepares a data-management plan before access or collection. It specifies lawful access, minimum necessary fields, consent and permissions, data ownership, access rights, encryption, retention, sharing, and destruction.

Sensitive data are encrypted in transit and at rest. Identifiers and linkage keys are separated from analysis datasets. Access is role-based, logged, reviewed, and removed promptly when duties end. Administrative accounts use multifactor authentication.

Each study evaluates reidentification risks involving bout dates, records, weight divisions, locations, rare events, and small groups. Public tables and shared datasets undergo disclosure review before release.

HIPAA applicability is assessed for Fight Medicine Research Institute and each data partner. For protected health information, the applicable authorization, IRB or Privacy Board waiver, or other lawful pathway is documented. A limited data set is handled under the applicable limited-data-set requirements and a data use agreement. A general data use agreement is not treated as authorization to disclose otherwise restricted identifiable health information.

Retention is documented for each project and follows the longest applicable legal, funding, contractual, IRB, and publication requirement. Research governance and publication-support records are retained for at least seven years after project closure as an internal minimum, unless a longer requirement applies. Destruction is documented and suspended when preservation duties arise.

Potential breaches trigger immediate containment, preservation of evidence, risk assessment, and required notifications. The Director assigns responsibility and documents corrective action.

Identifiable participant information must not be placed in public website repositories, ordinary inquiry forms, or unapproved AI services.