Ó£ÌÒÊÓƵ

Yes, you will need to notify the IRB in the portal that you will be switching to QuestionPro. How you modify your project will depend on the level of review it received (Exempt, Exempt with Limited IRB Review, Expedited, or Full Board). Not sure what your level of review is? Check the correspondence letter attached to that project in the portal.

• For Exempt projects without Limited IRB Review, add a Public Comment to your project in the portal indicating that you are migrating to QuestionPro. Attach any participant materials that might have changed (e.g., consent information, survey).
• For Exempt projects with Limited IRB Review, Expedited, and Full Board studies, submit a modification. You may have additional steps to take to modify the submission and consent form.

Yes, QuestionPro has features that allow surveys to meet privacy requirements of:

• General Data Protection Regulations (GDPR)
• Family Education Rights and Privacy Act (FERPA)
• California Consumer Privacy Action (CCPA)
• Payment Card Industry’s Data Security Standards (PCI-DSS)
• Section 508 (US Federal Accessibility Guidelines)
• Health Insurance Portability and Accountability Act (HIPAA)

Researchers must also comply with Ó£ÌÒÊÓƵ’s EITS Data Classification and Protection Standard and Minimum Security Standards Policies.

Yes, QuestionPro has privacy and confidentiality protections that are similar to Qualtrics. These features include encryption to securely transfer and store data within the system databases and Single Sign-On (SSO) to allow end-users to access their QuestionPro account using their Ó£ÌÒÊÓƵ credentials. In addition, QuestionPro has system tools to generate audit records and monitor access, failed authentication attempts, and other auditable events. Keep in mind that depending on the type of data you are collecting and the specific requirements of your project, additional data security, compliance, or technology systems may be necessary.

Provide the name of the system and the setting (QuestionPro system tool) that may impact the privacy and security of the data. Specific areas to consider include:Ìý

• The collection of the IP address. An Internet Protocol (IP) address is a unique, potentially identifying number assigned to every networked device. Because QuestionPro might collect a participant’s IP address by default, explain why you need this identifier, or state that you will disable the feature if not necessary for your research.Ìý

• Explain the platform’s security levels and settings to protect data during transmission. Secure Sockets Layer (SSL) and Transport Layer Security (TLS) are standard security technologies for encryption between a web server and a browser. You will see them in a URL as https://.Ìý Review and the for information that you can add to your IRB portal submission: Risk and Benefits page (description of risk mitigation).

• The date or project phase when you will switch to QuestionPro.Ìý

• Describe whether you will create one general survey link to send to all participants from your Ó£ÌÒÊÓƵ email account, or if you will email the survey through the QuestionPro platform, where individual survey links will be created and tracked. If you do not need to track if a specific individual responds to the link, please use a general link. The method you choose should align with the information already in the IRB portal regarding distribution of surveys.ÌýÌý

• If offering compensation, consider creating a second survey for the entry of participant information for compensation so that the personal information is not linked to the survey responses.Ìý

• If the consent process is built in the platform, the consent information must: be presented as the first screen of the survey and comply with Ó£ÌÒÊÓƵ HRPP policy requirements (Documentation of Informed Consent and Informed Consent Process for Research or Exempt Research, depending on the level of review for the project).Ìý

• While you must use a secure platform and protect responses (data stored after collection, or data at rest), you cannot absolutely control third-party access during transmission (data in transit). Therefore, be certain to include a statement that confidentiality cannot be guaranteed. Follow the Ó£ÌÒÊÓƵ HRPP policy for Internet Research and include one of the following or similar statements: Your confidentiality will be maintained to the degree permitted by the technology used. Specifically, no guarantees can be made regarding the interception of data sent via the Internet by any third parties. OR This research involves the transmission of data over the Internet. Every reasonable effort has been taken to ensure the effective use of available technology; however, confidentiality during online communication cannot be guaranteed.Ìý

• If you have designed an anonymous data collection and employed the system tools in the platform to ensure anonymity, explain in the consent that withdrawal of data is only possible before the survey responses are submitted. After they submit the responses, data cannot be removed.Ìý

• Consent TemplatesÌý