Handling Patient Data General Security Guidelines

Data Office

| Approval Date:

December 5, 2025 2:00 pm

Use of patient health data for research is a distinct privilege – not a right. To minimize the risk of unauthorized disclosure of patient data and other sensitive information, data security must be a top priority for all. Research performed at the University of Michigan is governed by related institutional and federal policies.

Guidance For Safe Data Handling

DO’S	DONT’S
Use a secure file share solution like DropBox	Ever e-mail files with PHI, even if using a secure Michigan Medicine Outlook e-mail account
All data should be stored on a secured shared drive or within an approved MM environment	Save files to your desktop
All data files must be encrypted	Remove password protection
Place participant identifier (MRNs names, addresses) data, and crosswalk key in separate, password-protected files	Share the crosswalk of identifiers
Know the details of the IRB approval	Collect more data than approved or share data with individuals not listed as research team members in the IRB.

IMPORTANT: The #1 cause of disclosure of PHI is Cyber Attacks, so do not rely on the MM firewall to protect sensitive data – take additional precautions.

Offices that Govern These Policies

UNIT: Data Office for Clinical & Translational Research

TOPICS: HIPAA & Protected Health Information / Investigator & Study Team Responsibilities

Questions?

North Campus Research Complex, Building 400, 1600 Huron Parkway, Ann Arbor, MI 48105

A list of Data Office contacts is available in the Personnel Directory.

Edited By: [email protected]
Last Updated: December 5, 2025 2:30 PM

Handling Patient Data General Security Guidelines

Guidance For Safe Data Handling

Offices that Govern These Policies

Questions?

See Also