CITI training Research
The researcher's failure to protect research subjects from deductive disclosure of identity (that is, the re-identification of subjects by other researchers) is the primary ethical violation in which of the following studies?
"Tastes, Ties, and Time (T3)" study
Identify one way faculty researchers can possibly avoid undue influence of student subjects?
Avoid recruiting their own students in the research
HIPAA allows healthcare organizations to control many information decisions. However, where the patient retains control, which of the following is true?
If a person has a right to make a healthcare decision, then generally that person has a right to control information associated with the decision.
According to the Belmont Report, the requirement that the benefits and burdens of the research are equitably distributed, expresses the principle of:
Justice
In a longitudinal study that will follow children from kindergarten through high school and will collect information about illegal activities, which of the following confidentiality procedures would protect against compelled disclosure of individually identifiable information?
Securing a Certificate of Confidentiality
Which of these is not generally a good practice for fax machine use?
Sensitive faxes -- inbound or outbound -- are left sitting in or around the machine.
A therapist at a free university clinic treats elementary school children with behavior problems who are referred by a social service agency. She is also a doctoral candidate who proposes using data she has and will collect about the children for a case-based research project. Which of the following statements about parental permission is correct?
The parents of the children might feel pressure to give permission to the therapist to use their children's data so that she will continue to provide services to their children.
Which choice best describes the purpose of most pharmacogenomic research
To evaluate the association between individual genotypes and the safety and efficacy of a particular drug or class of drugs
The primary way to determine whether an idea constitutes "common knowledge" is:
Whether there is an expectation that the readers and the author would be very familiar with the material.
Which of the following is correct about email transmission and storage?
While defensive technologies exist, it is still best to think of email as an electronic postcard, subject to potential access by third parties while in route or at its destination.
Which of the following practices can be effective in minimizing group harms?
- Collaborative IRB review - Ongoing consultation - Planning disclosure of research results - Community consultation
Which of the following studies has the LEAST potential to create group harm
A Phase 3 clinical trial of a new anticancer agent in middle-aged women diagnosed with breast cancer.
An investigator obtains consent and HIPAA authorization from subjects to review their medical records and HIV status. He plans to go back to the medical record, so the HIV status information is stored along with subject identifiers in a database that he keeps on his laptop computer. His laptop is stolen. This incident constitutes:
A breach of confidentiality
According to the federal regulations, human subjects are living individuals about whom an investigator conducting research obtains information through interaction or intervention with the individual, and uses, studies, or analyzes the information; or:
A cognitive psychologist enrolls undergraduate students for a computer-based study about the effect of mood on problem-solving behaviors.
Which of the following constitutes both a breach of confidentiality (the research data have been disclosed, counter to the agreement between researcher and subjects) and a violation of subjects' privacy (the right of the individuals to be protected against intrusion into their personal lives or affairs)?
A faculty member makes identifiable data about sexual behavior available to graduate students, although the subjects were assured that the data would be de-identified.
Information security's goals are sometimes described by the letters "CIA." Which of the following is correct definition of C, I, or A?
A is for Availability, which refers to the ability of legitimate users to access their data when needed. I is for Integrity, which refers to the accuracy of the data for its intended use, the security-equivalent of terms like validity and reliability. #1 and #3, not #2 C is for Confidentiality, which refers to limiting data access to appropriate persons for appropriate purposes. All of the above
Which is an example of a situation where deferential vulnerability might be a factor?
A physician recruiting patients to be subjects
A criterion for waiving informed consent is that, when appropriate, subjects are provided additional pertinent information after the study. In which of the following studies would it NOT be appropriate to provide subjects with information about missing elements of consent
A study in which subjects were assigned to study activities based on an undesirable or unflattering physical characteristic as assessed by members of the research team.
The results from research have been known to produce harms to members of the sampled population who do not actually participate in the research study. An example of the type of research that could result in group harms by stigmatizing members of the group (even for individuals who do not participate in the research) is
A study of the types and prevalence of sexually transmitted infections (STIs) in small rural towns in a midwestern state.
According to the federal regulations, which of the following studies meets the definition of research with human subjects?
A study of twenty 4th grade classrooms in which researchers ask the schools to systematically vary the time of day reading is taught, and collect weekly assessments of reading comprehension for each child over a three-month period.
Your informed consent form must describe
All foreseeable risks and discomforts.
Which of the following is an example of how the principle of beneficence is applied to a study involving human subjects?
An experiment is proposed on the relationship between gender-related stereotypes in math and the subsequent performance by males and females on math tests.
Identify the example of when situation and time are key to assessing risk of harm in a research study
Asking women if they have had an abortion
A researcher wants to invite therapists to participate in small focus groups to discuss their perceptions regarding "troubled" adolescent girls and the relationships they have with their parents. Specific clients of the therapists will not be discussed. Which of the following will be the most important issue for the researcher to consider when planning the research?
Breach of confidentiality from the focus group subjects (therapists)
Under the federal HIPAA regulations, state health privacy laws:
Can remain in force if "more stringent" than HIPAA, complementing HIPAA's foundation of protections, provided there is no direct conflict in requirements.
A researcher is conducting a written survey about people's attitudes toward walking as an exercise option at the local shopping mall that supports a walking program. The survey is anonymous (without codes, names, or other information) and subjects may complete the survey and place it in a box at the shopping mall exits. Which of the following is the most important issue that the researcher addressed in planning the research
Confidentiality of the individual subject's responses
A student plans on interviewing 15 principals in neighboring high schools. The student plans to collect data about the personal experiences the principals have had with disruptive students, including the types of disciplinary actions that were taken (including decisions they may have personally made) and their feelings or thoughts regarding whether those actions were appropriate. The research data collected could have an impact on the principals' careers. The student will collect identifiers. This study would be subject to which type of review?
Convened Review
As of January 2015, the NIH expects investigators to obtain the informed (valid) consent of research participants in NIH -funded genetic research for broad research use of data and data sharing, even if the cell lines or specimens are
De-Identified
Use of social media tools and other new technologies to facilitate training-related communications is:
Depends on the organization's policies, so you should check with your organization's officials about what is allowed or prohibited.
Data are made anonymous by
Destroying all identifiers connected to the data.
Which of the following is an example of how the principle of beneficence can be applied to a study employing human subjects?
Determining that the study has a maximization of benefits and a minimization of risks.
A subject participates in a drug study because treatment is available at no or reduced cost, and he could not otherwise afford it. This is an example of:
Economic vulnerability
Which of the following is a correct statement about the security risks of email attachments and links embedded within emails?
Email attachments and web links that are sent in messages should be confirmed as safe. Recipients inevitably rely on the sender for such security details. Email attachments and web links that are received in messages should be confirmed as safe. Recipients should be wary, even if the sender is known and considered safe. Email attachments and links within emails can represent a major security risk. all of the above
Which of the following is a good practice for protecting computing devices
Ensuring anti-virus and other software is kept up-to-date. That includes keeping up with patches for the operating system itself, and upgrades to whatever browser and email software is used.
Enabling encryption of all data on a portable device is generally considered:
Essential for any portable device.
Which of the following is a good security practice for email?
Exercising care with every email message received, especially email containing file attachments that may be infected
Which of the following is a good security practice for web browsing?
Exercising caution before downloading files or any other clicking activity at a website.
A researcher wishes to study generational differences in coping mechanisms among adults who experienced abuse as children. Adequate measures will be instituted to obtain informed consent and ensure that there is no breach of confidentiality. The most likely additional risk is that some subjects may
Experience emotional or psychological distress.
Where could student researchers and/or student subjects find additional resources regarding the IRB approval process? Select all that apply.
Faculty Advisor/Research Mentor IRB Office
Patients have to provide an additional, specific authorization for training uses and disclosures of their information.
False
How long is an investigator required to keep consent documents, IRB correspondence, and research records?
For a minimum of three years after completion of the study
Secure disposal of a portable device at the end of its service life is:
Generally considered essential for all devices. One should not assume there is no sensitive personal or organizational data on a device or accessible by it.
Which choice is the best definition of "genetic determinism?"
Genes are primarily responsible for human traits, including health, behavior, and disease
Identify which types of discrimination the Genetic Information Non-Discrimination Act (GINA) protects individuals from
Health insurance and employment discrimination
Which of these is a greater risk "off site" than when a computer is used in a protected office environment?
Human threats - such as theft. Answer 1 and 2 Device malfunctions - such as a hard drive crash. "Environmental" threats - such as water, electrical or fire damage. All of the above
Unless the subject matter is considered common knowledge, citations are necessary when writing about:
Ideas, methodologies, or data from other authors and also your own previously published ideas, methodologies, or data.
Which is true of inducements in research
Inducements constitute an "undue influence" if they alter a potential subject's decision-making processes, such that they do not appropriately weigh the risk-benefit relationship of the research.
What "technical measures" do you usually need to take with an off-site computer?
Install anti-virus and anti-spyware software. Use a firewall or other intrusion detection/prevention system. Keep the operating system and applications software updated. Use passwords and other authentication mechanisms to protect against unauthorized access. All of the above
Software on a portable device should be
Installed or updated only from trusted sources to be certain that it is a legitimate version.
Which of the following is considered a SBR data collection method
Interviews
Risk of harm in social and behavioral sciences generally fall in three categories, which are
Invasion of privacy, breach of confidentiality, and study procedures
An idea is most likely to represent "common knowledge" if:
It can be safely assumed that the readers and the author are both thoroughly familiar with the idea and its source.
A researcher submits a study to the IRB that proposes to evaluate a new after-school on-line tutoring program for middle-school students in a local school district examining the effect on student grades. She proposes to perform this assessment at the school that her children attend, because she is familiar with the school district. Students may use either their personal smartphone or computer to participate in the program. This study might be determined to be violating which principle of the Belmont Report?
Justice
What "physical" security measures do you usually need to take for an off-site computer?
Keep secure backup copies in a separate, physically secure location. Answer 1 and 3 Keep the computer locked up - or in a locked room - to prevent physical access by others. Pay attention to the environmental safety of the computer's location - to prevent damage by water, etc. All of the above
Which of the following most accurately describes the risks associated with SBR?
Less predictable, more variable, and less treatable than physical harms
What "administrative" measures do you usually need to take?
Limit who can use the computer. Answer 2 and 3 Limit how the computer can be used - for example, no peer-to-peer downloads. Limit what kinds of data can be stored on the computer. All of the above
Email signatures should:
May be mandated by an organization's policies, which policies may also set limits on what can be in a signature. Contain basic contact information (such as name, title, phone number[s], and relevant addresses). May be omitted if it can be assumed that the recipient already has all this information. All of the above
Continuing review of an approved and ongoing study posing more than minimal risk that was initially approved by a convened IRB:
Must occur within 12 months of the approval date.
Ensuring data backups for data stored on a portable device is generally considered:
Necessary when the device would otherwise be the only source of hard-to-replace data, but the backup mechanism must also be secure.
According to federal regulations, the expedited review process may be used when the study procedures pose
No more than minimal risk and the research activities fall within regulatory categories identified as eligible.
For health information privacy and security, are the legal and regulatory requirements for students different from those for regular members of the healthcare workforce?
No, students must meet the same standards as a regular member of the workforce performing the same tasks.
Ethical writing and scholarship is based on an implicit contract between the author and readers, whereby readers assume that what they read is accurate, has been written by the author, and has:
Not been disseminated before unless noted otherwise.
If disclosure of a subject's involvement in a specific research study can be potentially harmful to the subject, and the consent form is the only record linking the subject to the research, which of the following would be most helpful
Obtain a waiver of documentation of informed consent.
IRB continuing review of a greater than minimal risk approved protocol that is currently enrolling subjects must
Occur at least annually.
Which of the following statements about the relationship between an institution and the institution's IRB(s) is correct?
Officials of the institution may overrule an IRB approval.
Desktop computers are often provided in the workplace by organizations, and laptops may be as well. However, portable devices (such as tablets and smartphones) may more commonly be allowed on a BYOD basis. For a BYOD (personally-owned) device
Organizations may have requirements about how BYOD devices may be configured or used, as a condition of accessing the organization's information resources.
Which of the following studies is linked most directly to the establishment of the National Research Act in 1974 and ultimately to the Belmont Report and federal regulations for human subject protection?
PHS Tuskegee Study
The Belmont Report's principle of respect for persons incorporates at least two ethical convictions: first, that individuals should be treated as autonomous agents, and second, that:
Persons with diminished autonomy are entitled to protection.
According to the authors, there are four common abuses that historically are described as giving rise to vulnerability. Which response below contains the correct four?
Physical control, coercion, undue influence, and manipulation
Which of the following is a good practice for controlling computer access?
Picking strong passwords and protecting them appropriately.
Identify the following groups that are protected in the federal regulations (45 CFR 46), specifically in Subparts B, C, and D with additional protections
Pregnant women, prisoners, children
In addition to pregnant women, fetuses, and neonates, another subpart of the HHS regulations provides additional protections for which of the following vulnerable populations?
Prisoners
The primary purpose of a Certificate of Confidentiality is to
Protect identifiable research information from compelled disclosure.
Organizations covered by the federal HIPAA privacy law are expected to:
Protect the health information under their control, train their workers in how to protect information, and help patients exercise their rights under the law.
When authors summarize the work of others, they typically should:
Provide a condensed (shorter) version of the original material.
As part of the consent process, the federal regulations require researchers to
Provide potential subjects with information at the appropriate reading comprehension level.
A researcher is interested in assessing risk-taking by individuals. The researcher is sitting on a bench near a busy four-way stop intersection. She plans on recording the number of bike riders wearing a safety helmet and whether they stop at the intersection before proceeding in order to correlate use of safety apparel with risk-taking. This collection of information is an example of:
Public behavior
A subject in a clinical research trial experiences a serious, unanticipated adverse drug experience. How should the investigator proceed, with respect to the IRB, after the discovery of the adverse event occurrence?
Report the adverse drug experience in a timely manner, in keeping with the IRB's policies and procedures, using the forms or the mechanism provided by the IRB.
Which of the following are the three principles discussed in the Belmont Report?
Respect for Persons, Beneficence, Justice
What kinds of content should generally not be sent in email?
Sensitive personal information like social security numbers, credit card numbers, and computer user-IDs and passwords. Sensitive information that an organization's email policies have determined to be inappropriate for email. Entire files or record sets, when only a subset is needed for the business purpose. Material that could be considered defamatory, harassing, racist, sexist, obscene, or otherwise offensive. All of the above
How are the ethical standards for student uses and disclosures of patients' health information different from those for regular members of the healthcare workforce?
Some would say it is higher, because patients do not always benefit from students' access to their data.
Disclaimers and confidentiality notices are a common feature of business emails. Which of the following is correct?
Such notices should be included if an organization's policies require it, but cannot be counted upon as legal protection.
A general requirement for informed consent is that no informed consent may include any exculpatory language. Exculpatory language is that which waives or appears to waive any of the subject's legal rights or releases or appears to release those conducting the research from liability for negligence. Which of the following statements in a consent form is an example of exculpatory language?
Taking part in the research is voluntary, but if you choose to take part, you waive the right to legal redress for any research-related injuries.
Amendments involving changes to IRB-approved protocols do NOT need prior IRB approval if:
The changes must be immediately implemented for the health and well-being of the subject.
Which of the following is a correct statement about the balance among prevention, detection, and response (PDR)?
The greater the sensitivity and quantity of the data at issue, the more carefully the balance among these three must be evaluated.
A waiver of the requirement for documentation of informed consent may be granted when
The only record linking the subject and the research is the consent document and the principal risk is a breach of confidentiality.
In order to grant a waiver or alteration of the requirements of informed consent, an IRB must find which of the following
The research could not practicably be carried out without the waiver of consent.
According to the federal regulations, research is eligible for exemption, if:
The research falls into one of eight categories of research activity described in the regulations.
When a focus group deals with a potentially sensitive topic, which of the following statements about providing confidentiality to focus group participants is correct
The researcher cannot control what participants repeat about others outside the group.
A researcher wants to conduct a secondary analysis using a Centers for Disease Control and Prevention (CDC) database that was collected by the agency solely for surveillance purposes from 1996-2006. The researcher did not participate in the initial collection of the data. The database is publicly available. The database does not include any identifiers. The IRB makes a determination that the individuals whose records will be reviewed do not meet the federal definition of human subjects
The researcher will not be interacting/intervening with subjects and the data has no identifiers.
According to federal regulations, which of the following best describes when expedited review of a new, proposed study may be used by the IRB?
The study involves no more than minimal risk and meets one of the allowable categories of expedited review specified in federal regulations
A researcher leaves a research file in her car while she attends a concert and her car is stolen. The file contains charts of aggregated numerical data from a research study with human subjects, but no other documents. The consent form said that no identifying information would be retained, and the researcher adhered to that component. Which of the following statements best characterizes what occurred
There was neither a violation of privacy nor a breach of confidentiality.
Which of the following statements is accurate in determining subject risk involved in a genetic study
Understanding the purpose and context of a specific study is critical in determining the risk involved
Which of these is generally not a good practice with respect to oral communications (that is, talking) in organizations like healthcare facilities?
Use of full names in public areas or on intercom/paging systems, because there is no security issue with identifying persons in public areas and using full names helps avoid misidentification.
With respect to permissions for uses and disclosures, HIPAA divides health information into three categories. Into which category does information related to "treatment, payment and health care operations" go?
Uses or disclosures that can generally occur without any specific permission from the patient.
With respect to permissions for uses and disclosures, HIPAA divides health information into three categories. Into which category do discussions with family members go?
Uses or disclosures that generally require oral agreement only.
Which of the following is a good practice if one wishes to avoid "social engineering" attacks?
Using strict procedures when it is necessary to exchange an authentication credential like a password, PIN, account number, or other personal data that is critical to establishing personal identity. Being cautious any time someone asks for sensitive information, whether by phone, fax, email, or even in person. It could be a scam. Not opening attachments or clicking on links in messages, emails, or on websites unless absolutely sure of the source's authenticity. Taking appropriate steps to confirm a person's (or site's) identity for any transaction that involves sensitive data.
Which of these is not generally a good practice for telephone use?
Using voicemail systems and answering machines that do not require a password or PIN for access.
In regard to reporting privacy or security problems, are the requirements for students the same as for regular workers?
Yes. Like any other member of the workforce, students are obligated to report problems they are not in a position to correct.
Which type of IRB review does not require an IRB approval but does require a determination by an individual designated with that task (such as an IRB member or experienced staff person)?
ijijl