Page 258 - eBOOK VERSION 8 BOOK 2 of 2 JUL 2022

STANDARD OPERATING Research Administration PROCEDURE
SOP No: Q016 SOP Title: Standard Review Assessment
1. INTRODUCTION & PURPOSE
The Standard Review Committee (SRC) exists to provide a multi- functional representation of key areas within Information Services, to establish the standards for software and hardware necessary to support the business needs of the Children’s Health System of Texas (CHST). Additionally, to review, evaluate, and provide recommendations for any addition of new software and/or hardware based on technology changes, business needs, or organization growth.
Research Administration (RA) and SRC at Children’s HealthTM have developed a process to verify that medical devices or technologies used in research and interacting with Children’s Health Wi-Fi network are secure and have enabled protections to safeguard data (de-identified, identified, or limited data set) that is being transmitted to external partners (outside of Children’s/UTSW environment).
2. SCOPE
This SOP applies to all study applications submitted to the IRB which lists CMC as a performance site.
Qualifying Devices/Technologies/Systems –
• Biometric Devices (e.g., Fitbit) - FitBits’ do not have an operating system but do store data and this could be downloaded to Children’s network or issued devices (e.g., iPad, iPhone, Android devices, tablet) wirelessly
• Projects involving electronic storage (e.g., electronic data capture) or processing of CMC personally identifiable information (PII) or Protected Health Information (PHI) via a non-CMC 3rd party/mobile application/non-CMC platform. - includes PHI, but not de-identified data
• Projects that will create a website on the CMC domain (www.childrens.com) and it will be exposed to the Internet/public for viewing.
• Studies that will create and utilize a mobile application to be used on Children’s issued devices (iPad, iPhone, tablet, etc.)
• Any external or vendor systems that will attempt to integrate with a CMC system, e.g., Children’s EPIC
• Any project that will utilize “cloud” storage or computing infrastructure (e.g., Dropbox, Amazon Cloud Services, EC2).
• Sponsor issued technologies (laptop/desktop/e-Diaries) – These devices typically do not have Children’s encryption and security software loaded on the unit. Any data that is being transmitted across Children’s network may be at risk of exposure
Version 5, 02-19-2021, 08-19-21, 05-31-22 Page 3 of 9