{"id":17076,"date":"2026-07-20T11:20:38","date_gmt":"2026-07-20T15:20:38","guid":{"rendered":"https:\/\/www.rochester.edu\/ohsp\/?page_id=17076"},"modified":"2026-09-29T13:43:47","modified_gmt":"2026-09-29T17:43:47","slug":"breaches-of-confidentiality","status":"publish","type":"page","link":"https:\/\/www.rochester.edu\/ohsp\/resources\/breaches-of-confidentiality\/","title":{"rendered":"Breaches of Confidentiality"},"content":{"rendered":"","protected":false},"excerpt":{"rendered":"","protected":false},"author":82,"featured_media":0,"parent":236,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":"","_members_access_role":[],"_members_access_error":""},"class_list":["post-17076","page","type-page","status-publish","hentry"],"acf":{"lead_in":"","display_title":"Breaches of Confidentiality ","subtitle":"","call_to_action":"","hero_image_placement":"no_image","hero_media":"images","hero_pattern_option":"","hero_video":"","hero_image_landing":"","hero_image_landing_two":"","hero_image_landing_three":"","content_modules":[{"acf_fc_layout":"text","anchor":"","css_class":"","title":"<h2>Description<\/h2>","content":"Investigators are responsible for the confidentiality of participant information collected during the course of a study, including how this information will be stored and shared. A breach of confidentiality is an\u00a0unanticipated problem\u00a0that must be reported to the IRB. Additional requirements apply if the breach involves Protected Health Information (PHI) covered under HIPAA regulations.\r\n\r\nExamples of data breaches include, but are not limited to, the following:\r\n<ul>\r\n \t<li>Lost or stolen laptops storing participant information<\/li>\r\n \t<li>Lost or stolen USB\/thumb drives with unencrypted participant information<\/li>\r\n \t<li>Information delivered to the wrong participant using the postal service, courier, or other delivery method<\/li>\r\n \t<li>Accessing PHI without a\u00a0<em>business<\/em>\u00a0need to know<\/li>\r\n \t<li>Any unencrypted PHI sent outside of the institution\r\n<ul>\r\n \t<li>This includes using unsecured protocols, such as FTP and Telnet, and not encrypting web pages when participant information is being transmitted<\/li>\r\n<\/ul>\r\n<\/li>\r\n \t<li>Paper with PHI not disposed of properly - i.e., shredded<\/li>\r\n<\/ul>","background_color":"#ffffff","width":"width-medium"},{"acf_fc_layout":"text","anchor":"","css_class":"","title":"<h2 id=\"how_to_report_breaches_of_confidentiality_3\" tabindex=\"-1\">How to Report Breaches of Confidentiality<\/h2>","content":"It is important that breaches of confidentiality be reported promptly in order to address the breach and reduce the level of risk to participants. Investigators should follow these procedures for reporting breaches of confidentiality to the University and the IRB.\r\n\r\n<a class=\"button button--blue\" href=\"https:\/\/sites.mc.rochester.edu\/departments\/hipaa\/hipaa-privacy-officers-and-security-officials\/\">Contact the Privacy Office for more information<\/a>","background_color":"#f4f4f4","width":"width-medium"},{"acf_fc_layout":"text","anchor":"","css_class":"pt-15","title":"<h5>Submit an RNI to the IRB:<\/h5>","content":"<ul>\r\n \t<li><a href=\"https:\/\/www.rochester.edu\/ohsp\/irb-review\/irb-submissions\/reports-of-new-information\/\">Complete a Report\u00a0of New Information via ClickIRB<\/a><\/li>\r\n \t<li>Describe the breach in detail, including the number of participants affected and type of information that was compromised. Also, describe the timeline of events for the breach and institutional action.<\/li>\r\n \t<li>Describe any action that has already been taken by the principal investigator or study team to remedy or halt the breach.<\/li>\r\n \t<li>Include any correspondence and instructions from the Privacy Office, if applicable. Include the names of the individuals with whom you have been in contact.<\/li>\r\n \t<li>If the breach occurred as the result of a crime, include the police report number.<\/li>\r\n \t<li>Notify the study sponsor, if applicable.<\/li>\r\n \t<li>Be sure to include any supporting documents with the application to explain the event.<\/li>\r\n \t<li>If you will be making changes to the study based on the information you are reporting, a modification will be needed. \u00a0Once the modification application has been created, it will be available to select as a related submission in the RNI application (#8) if you have selected the parent study. \u00a0Use the help text (question button) in the RNI application #8 for assistance if the modification is not showing up in the list of options.<\/li>\r\n<\/ul>","background_color":"#f4f4f4","width":"width-medium"},{"acf_fc_layout":"text","anchor":"","css_class":"pt-15","title":"<h5>Breach of Confidentiality Review Process<\/h5>","content":"The IRB will work with the Privacy Office to determine if and how participants should be notified of the breach. The IRB review process for the RNI will typically include participant notification as a corrective action for the investigator.\r\n\r\nThe IRB and Privacy Office are also required to notify regulatory agencies, study sponsors, and institutional officials about the determinations regarding the breach. This may include the following:\r\n<ul>\r\n \t<li>Health and Human Services Office of Human Research Protection (OHRP)<\/li>\r\n \t<li>FDA, if the study is subject to FDA regulations<\/li>\r\n \t<li>The designated Institutional Official over research at the applicable institution(s)<\/li>\r\n \t<li>Office(s) of Risk Management at the applicable institution(s)<\/li>\r\n \t<li>Supervisor of the principal investigator<\/li>\r\n<\/ul>","background_color":"#f4f4f4","width":"width-medium"}]},"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.4 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Breaches of Confidentiality - Office for Human Subject Protection<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.rochester.edu\/ohsp\/resources\/breaches-of-confidentiality\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Breaches of Confidentiality - Office for Human Subject Protection\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.rochester.edu\/ohsp\/resources\/breaches-of-confidentiality\/\" \/>\n<meta property=\"og:site_name\" content=\"Office for Human Subject Protection\" \/>\n<meta property=\"article:modified_time\" content=\"2026-09-29T17:43:47+00:00\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.rochester.edu\\\/ohsp\\\/resources\\\/breaches-of-confidentiality\\\/\",\"url\":\"https:\\\/\\\/www.rochester.edu\\\/ohsp\\\/resources\\\/breaches-of-confidentiality\\\/\",\"name\":\"Breaches of Confidentiality - Office for Human Subject Protection\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.rochester.edu\\\/ohsp\\\/#website\"},\"datePublished\":\"2026-07-20T15:20:38+00:00\",\"dateModified\":\"2026-09-29T17:43:47+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.rochester.edu\\\/ohsp\\\/resources\\\/breaches-of-confidentiality\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.rochester.edu\\\/ohsp\\\/resources\\\/breaches-of-confidentiality\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.rochester.edu\\\/ohsp\\\/resources\\\/breaches-of-confidentiality\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.rochester.edu\\\/ohsp\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Resources\",\"item\":\"https:\\\/\\\/www.rochester.edu\\\/ohsp\\\/resources\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Breaches of Confidentiality\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.rochester.edu\\\/ohsp\\\/#website\",\"url\":\"https:\\\/\\\/www.rochester.edu\\\/ohsp\\\/\",\"name\":\"Office for Human Subject Protection\",\"description\":\"University of Rochester\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.rochester.edu\\\/ohsp\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Breaches of Confidentiality - Office for Human Subject Protection","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.rochester.edu\/ohsp\/resources\/breaches-of-confidentiality\/","og_locale":"en_US","og_type":"article","og_title":"Breaches of Confidentiality - Office for Human Subject Protection","og_url":"https:\/\/www.rochester.edu\/ohsp\/resources\/breaches-of-confidentiality\/","og_site_name":"Office for Human Subject Protection","article_modified_time":"2026-09-29T17:43:47+00:00","twitter_card":"summary_large_image","schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.rochester.edu\/ohsp\/resources\/breaches-of-confidentiality\/","url":"https:\/\/www.rochester.edu\/ohsp\/resources\/breaches-of-confidentiality\/","name":"Breaches of Confidentiality - Office for Human Subject Protection","isPartOf":{"@id":"https:\/\/www.rochester.edu\/ohsp\/#website"},"datePublished":"2026-07-20T15:20:38+00:00","dateModified":"2026-09-29T17:43:47+00:00","breadcrumb":{"@id":"https:\/\/www.rochester.edu\/ohsp\/resources\/breaches-of-confidentiality\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.rochester.edu\/ohsp\/resources\/breaches-of-confidentiality\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.rochester.edu\/ohsp\/resources\/breaches-of-confidentiality\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.rochester.edu\/ohsp\/"},{"@type":"ListItem","position":2,"name":"Resources","item":"https:\/\/www.rochester.edu\/ohsp\/resources\/"},{"@type":"ListItem","position":3,"name":"Breaches of Confidentiality"}]},{"@type":"WebSite","@id":"https:\/\/www.rochester.edu\/ohsp\/#website","url":"https:\/\/www.rochester.edu\/ohsp\/","name":"Office for Human Subject Protection","description":"University of Rochester","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.rochester.edu\/ohsp\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"}]}},"_links":{"self":[{"href":"https:\/\/www.rochester.edu\/ohsp\/wp-json\/wp\/v2\/pages\/17076","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.rochester.edu\/ohsp\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/www.rochester.edu\/ohsp\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/www.rochester.edu\/ohsp\/wp-json\/wp\/v2\/users\/82"}],"replies":[{"embeddable":true,"href":"https:\/\/www.rochester.edu\/ohsp\/wp-json\/wp\/v2\/comments?post=17076"}],"version-history":[{"count":11,"href":"https:\/\/www.rochester.edu\/ohsp\/wp-json\/wp\/v2\/pages\/17076\/revisions"}],"predecessor-version":[{"id":20406,"href":"https:\/\/www.rochester.edu\/ohsp\/wp-json\/wp\/v2\/pages\/17076\/revisions\/20406"}],"up":[{"embeddable":true,"href":"https:\/\/www.rochester.edu\/ohsp\/wp-json\/wp\/v2\/pages\/236"}],"wp:attachment":[{"href":"https:\/\/www.rochester.edu\/ohsp\/wp-json\/wp\/v2\/media?parent=17076"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}