As the volume of Stanford data continues to grow exponentially, so do the risks associated with storage, processing, and management. To safeguard sensitive information, the University Privacy Office (UPO) and Information Security Office (ISO) conduct data risk assessments (DRAs).
A DRA is a review of whether a proposed transfer Moderate or High Risk data to a non-Stanford entity is consistent with Stanford’s Minimum Security Standards and Minimum Privacy Standards. Before sending or receiving Moderate or High Risk data to or from a non-Stanford partner, you must submit a DRA to evaluate the extent of risk to the university. OneTrust is a tool to request, track, collaborate on, and automate DRAs at Stanford.
Who should submit DRAs and for what reasons?
- Stanford researchers and other teams should submit a DRA request before sending or receiving "Moderate Risk" or “High Risk” data (as defined under Stanford’s Risk Classifications) to or from a non-Stanford or external entity.
- If the non-Stanford or external entity sending or receiving the High Risk data has no direct relationship with Stanford but does have a contractual agreement with the sponsor or Clinical Research Organization (CRO) to provide the services — e.g., use of electronic data capture (EDC), electronic case report forms (CRFs), or electronic diaries — a DRA review of that non-Stanford partner is typically not required. The sponsor/CRO assumes the responsibilities for managing the privacy and security risks associated with that third party relationship.
- Non-Stanford or external entities that support Stanford hospitals, where the contract falls under the hospitals, should not go through this DRA process. Please reach out to the Hospital Privacy Office at PrivacyOfficer@stanfordhealthcare.org, or the Hospital Security Office on privacy or security questions.
What information will I need to provide when completing the DRA form?
In the revised automated DRA submission form, you’ll be asked questions related to Stanford’s Minimum Security Standards (minsec.stanford.edu) and Minimum Privacy Standards (minpriv.stanford.edu). If you have all of the necessary details, it will take less than 45 minutes to complete the form.
Please be prepared to provide the following details in responding to the questions:
- All the data element types to be sent or received by Stanford
- The purposes of the data use and transfer
- The project’s IRB protocol number
- The non-Stanford entities that will provide, process, or receive PHI/PII
- Copies of relevant Data Use Agreements (DUA)
- Copies of Waivers
- Copy of draft Notice and Consent document, if data will be collected directly from participants
- Confirmation that all project members have successfully completed HIPAA or other privacy training
- The project’s go-live date (past or future)
- Where the data will be stored within Stanford
- What the recommended retention period for the PHI/PII data is and how long your team anticipates project data will be kept.
- If working with a non-Stanford entity, the name and contact email of the entity, and whether they have previously provided services to Stanford.
- The non-Stanford entity will also have to respond to a separate non-Stanford entity questionnaire relating to their security practices, and provide copies of the non-Stanford third-party attestations.
Note: For China-based studies, please reach out to the Privacy Office at https://privacyrequest.stanford.edu for a consultation before submitting a DRA.
