Case 1

• VA Researchers have initiated a study to measure employee satisfaction levels in the ER.

• An ER nurse has agreed to participate as long as his sensitive information is not disclosed outside of the VA.

• A hard working research assistant decides to take to an alternate VA location a folder of research info related to the study. Unfortunately, he drops a few documents from the folder on a Metro bus and a document with the ER nurse’s name and education history is left behind.

Case 1 – Question 1Is the document that was dropped an example of sensitive personal information?

1. Yes2. No

Case 1 – Question 2Which of the following is/are required to transport sensitive personal information from one VA facility to another?

1. Express written consent from the Principal Investigator

2. Lockable briefcase with padlock feature

3. Authorization to remove VA Sensitive Information from VA protected environments

4. Medical Center Director oral authorization

Case 2

When the research assistant gets home and realizes that he has dropped a few documents, he panics and calls his ISO. While speaking with the ISO he also realizes that he has lost the list of 100 potential VA employee subjects along with their VA email addresses that the PI got off the VA web site in preparation for this study.

Case 2 – Question 1Are the employee names and VA email addresses considered VA Sensitive Information?

1. Yes2. No

Case 3

Lastly, the research assistant notices that he has misplaced some results of the employee satisfaction survey. None of the results identifies any employees by name nor does the info contain any sensitive personal information. The notes do contain the answers of one disgruntled employee who used this survey as an opportunity to vent against the Old Glory VAMC and VA as a whole.

Case 3 – Question 1Is this information considered VA Sensitive Information?

1. Yes2. No

Case 4 - Dumpster Diving

On a recent visit to Stars & Stripes VAMC, an ITOC site visitor discovers a large trash bag filled with shredded documents. Upon closer examination, the auditor realizes that there are legible patient names and SSNs on the shredder confetti.

Case 4 – Question 1How should the document have been processed to prevent this type of incident?

1. The documents should be disposed of only after being soaked in water for 30 minutes.

2. The documents should be disposed of using a VA approved single-cut shredder

3. The documents should not be shredded but rather, converted into packing material for VA mailroom shipping purposes.

4. The documents should be shredded using a cross-cut shredder

Case 5

There is an investigator at a VA affiliate who is a world-expert in PTSD. She has a huge new NIH grant to perform a study on PTSD that is very likely to yield extremely exciting results for Veterans. She is a close collaborator with VA researchers on several other projects.

Case 5 – Question 1Since this research has such important implications for Veterans, can this investigator access VA medical records?

1. Yes2. No

Case 6

The Research Office has finally gotten permission to hire new staff to help with all the new compliance requirements. The AO/R&D found a great room for the new staff, but it is full of many dozens of boxes of records for studies that ended 7 to 10 years ago.

Case 6 – Question 1Since all these studies ended at least 7 years ago, what should the AO do with the records?

1. Have the documents shredded by VA approved shredders

2. Save the documents until there is a VA policy for research record destruction

3. Send the documents to a federally funded “green” company that uses old paper to produce biofuels

4. Redact all sensitive information and then dispose of the documents in the recycle bin